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SUMMARY 

High  performance  combat  aircraft  require  Flight  Control  Systems  (FCS)  that  permit  the  attainment 
of  mission  objectives  within  the  constraints  of  cost,  weight,  volume,  reliability  and  maintainability. 
The  FCS  must  also  be  relatively  invulnerable  to  enemy  small  projectile  and  radiation  weaponry  and 
natural  hazards  such  as  lightning. 

The  complexity  and  variety  of  tasks  that  FCS's  are  called  upon  to  perform  has  been  steadily  in¬ 
creasing.  However,  the  application  of  new  technologies  such  as  fly-by-wire,  digital  computation, 
and  integrated  systems  will  permit  the  design  and  synthesis  of  FCS's  capable  of  meeting  these  highly 
demanding  requirements. 

This  report  presents  the  new  technologies  and  concepts  whose  development  has  been  advanced  by 
Navy  supported  Exploratory  and  Advanced  Development  Programs. 
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INTRODUCTION 


The  Naval  Air  Development  Center  (NADC)  has  been  and  is  currently  sponsoring  developmental 
programs  to  develop  and/or  apply  advanced  technologies  applicable  to  the  Flight  Control  Systems 
(FCS)  of  future  tactical  aircraft.  The  main  thrust  of  these  developmental  programs  is  toward  the 
development  of  an  advanced  type  of  FCS  -  a  next  generation  Digital  Flight  Control  System 
(DFCS)  employing  Flv-By-Wire  (FBW)  signal  paths.  The  major  goals  of  the  developmental  programs 
are  as  follows: 

•  Improvement  of  mission  performance  through  flight  control  technology. 

•  Increased  flight  safety  and  mission  reliability  via  redundancy  data  management. 

•  Reduced  vulnerability  to  combat  damage. 

•  Simplicity  and  reliability  through  standardized  and  interchangeable  components. 

•  Improved  maintainability  through  Built-In-Test  (BIT)  and  diagnostics. 

•  Reduced  weight  and  volume  requirements. 

•  Immunity  to  electro  magnetic  hazards/threats. 

The  flight  control  developmental  programs  sponsored  by  NADC  and  their  associated  contractors 
(as  of  report  date)  are  listed  as  follows: 

•  Development  of  an  Integrated  Sensory  Subsystem  (ISS)  -  The  Grumman  Aerospace  Corp. 

•  Development  of  a  Digital  Flight  Control  System  for  the  Advanced  Fighter  Technology 
Integration  AFTI/F-16  Aircraft  -  General  Dynamics  Corp.,  Fort  Worth  Division  (A  joint 
Navy,  Air  Force,  and  NASA  program). 

•  Development  of  Two  Advanced  and  Fault  Tolerant  Actuation  Concepts  for  FBW  Systems. 

•  Direct  Digital  Drive  (D^)  High  Pressure  (8000  psi)  Actuation  Concept  -  Rockwell 
International  Corp.,  Columbus  Division. 

•  Four-Valve  Tandem  FBW  Actuator  -  Bell  Helicopter  Textron,  Fort  Worth. 

•  Development  of  the  Hydra-Optic  Flight  Control  Actuation  System  (HOFCAS)  Concept  - 
Rockwell  International  Corp.,  Columbus  Division. 

The  ISS  exploratory  development  program  is  now  in  its  final  phase  and  should  be  available  for  the 
advanced  development  phase  in  the  near  future. 

The  first  phase  of  the  AFTI/F-16  program,  dedicated  to  the  development  of  a  triplex  DFCS  is 
still  in  progress  and  is  scheduled  to  be  completed  in  CY  1983.  The  first  flight  of  the  AFTI/F-16 
took  place  in  July  1982  and  is  now  in  its  initial  flight  test  program  at  the  Edwards  Air  Force  Base. 

The  six  phases  of  the  DJ  program  have  been  completed  with  the  actuation  concept  being  success¬ 
fully  test  flown  in  a  T-2C  aircraft.  A  follow  on  program  now  in  progress,  is  directed  to  the  develop¬ 
ment  of  a  compact  FBW  actuator  with  rotary  type  hydraulic  servo  valves,  their  electronic  packages, 
and  feedback  paths  imbedded  within  the  cylindrical  portion  of  the  actuator  body. 
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The  first  phase  of  the  Four- Valve  Tandem  FBW  Actuator  program  has  been  completed  in  July 
1980.  The  concept  has  been  successfully  demonstrated  via  laboratory  testing.  The  second  phase 
of  the  program  was  directed  toward  the  development  of  a  FBW  actuator  with  manual  revision 
capability  and  was  completed  in  November  1981. 

The  development  of  a  laboratory  version  of  the  HOFCAS  was  completed  in  December  1980. 

This  report  was  prepared  for  the  purpose  of  providing  simplified  descriptions  of  the  concepts  being 
developed.  A  follow-on  report  will  be  issued  to  document  future  flight  control  developmental 
programs  and  update  existing  programs. 


NADC-82240-60 


DESCRIPTION  OF  THE  INTEGRATED  SENSOR Y  SUBSYSTEM  (ISS)  CONCEPT 


The  Naval  Air  Development  Center  defii.rd  the  requirement  for  an  Integrated  Sensory  Subsystem 
(ISS)  after  observing  the  numerous  sensory  subsystems  employed  on  their  F-14  aircraft.  Several 
subsystems  on  the  aircraft  had  dedicated  inertial  and  air  data  type  sensors  with  the  result  being  an 
inefficient  and  wasteful  proliferation  of  sensors.  Under  contracts  to  the  Naval  Air  Development 
Center  (NADC)  GAC  evolved  and  developed  the  ISS  concept  which  permits  an  optimal  integration 
of  sensors  with  redundant  digital  computers  or  microprocessors  so  that  the  outputs  of  a  basic  set 
of  sensors  can  be  shared  and  used  by  such  aircraft  subsystems  as  the  following: 


•  Digital  Flight  Control  System  (DFCS). 

•  Cockpit  instrumentation  and  displays. 

•  Engine  inlet  control. 

•  Engine  thrust  control. 

•  Wing  sweep  control. 

•  Inertial  Navigation  System  (INS). 

•  Weapon  delivery. 

In  addition,  in  order  to  meet  very  stringent  reliability  and  survivability  requirements  future  high 
performance  combat  aircraft  will  incorporate  redundant  systems  and  components,  further  compli¬ 
cating  the  sensor  requirements. 

A  fully  developed  ISS  will  provide  the  following  benefits: 

•  Increased  flight  safety  and  mission  reliability  for  aircraft  incorporated  with  Digital  Fly-By-Wire 
(DFBWi  systems  and  Relaxed  Static  Stability  (RSS)  through  the  use  of  redundant  sensors  and 
redundancy  management. 

•  Decreased  vulnerability  to  combat  damage  by  the  dispersal  of  components. 

•  Reduced  parts  count  and  inventory  requirements. 

•  Reduced  maintenance. 

•  Reduction  of  weight  and  volume. 

•  Increased  operational  readiness. 

An  ISS  is  composed  of  the  following  three  main  elements: 

( 1 )  A  functionally  reliable  and  combat  damage  survivable  sensor  set  consisting  of  the  following: 

•  Redundant  low  and  high  speed  multi-purpose  air  data  probes. 

•  Six  hard  mounted,  skewed,  and  dispersed  rate  integrating  gyros. 

•  Six  hard  mounted,  skewed,  and  dispersed  linear  accelerometers. 
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(2)  An  Input/Output  (I/O)  System  that  links  the  data  from  the  redundant  air  and  inertial  data 
sensors  to  a  redundant  digital  and/or  distributed  microprocessor  complex  for  processing. 

The  signal  paths  of  the  I/O  system  may  be  in  the  form  of  hard  wiring,  multiplex  bus,  or  fiber 
optics,  or  any  combination  thereof. 

(3)  A  computation  network  within  a  redundant  digital  computer  complex  consisting  of  sub¬ 
routines  that  provide: 

•  Sensor  data  preprocessing  to  compensate  for  position  errors  and  filtering  of  sensor  outputs. 

•  Sensor  redundancy  data  management  for  sensor  signal  selection,  failure  detection,  and 
failure  isolation. 

•  State  estimation  and  sensor  data  normalization  algorithms  to  account  for  deterministic 
errors  associated  with  body  bending  coupling,  dispersion  of  sensors,  and  random  sensor 
noise. 

•  Strapdown  attitude  and  heading  reference  computations  for  the  skewed  and  dispersed 
inertial  sensors. 

•  Air  data  computations  for  altitude,  altitude  rate,  true  airspeed,  true  Mach  number,  dynamic 
pressure,  angle  of  attack  (a  ),  angle  of  sideslip  (0),  true  static  pressure,  and  total  air 
temperature. 

The  calculated  parameters  resident  in  the  computer  memories  are  transmitted  to  the  using  subsys¬ 
tems  on  a  time  shared  basis.  Figure  1  is  a  Schematic  and  Signal  Flow  Diagram  of  the  ISS  Concept. 

The  vectors  shown  in  a  conical  arrangement  represent  the  sensing  axes  of  the  six  skewed  rate  gyros 
and  the  six  skewed  linear  accelerometers.  Inputs  to  the  redundant  flight  control  digital  computer 
complex  that  are  from  systems  not  a  part  of  the  ISS  are  marked  with  an  asterisk.  The  required  com¬ 
putations  for  the  ISS  Concept,  as  illustrated  in  Figure  1,  are  performed  in  the  redundant  flight  con¬ 
trol  digital  computer  complex  on  a  time  shared  basis.  All  of  the  inputs  to  the  computer  complex 
are  used  in  the  flight  control  and  navigation  tasks.  However,  the  inputs  from  the  INS  and  the  flux 
valves  are  also  used  to  aid  in  the  redundancy  management  of  the  ISS  air  data  system. 

Figure  2  is  a  schematic  of  the  major  components  of  the  ISS  and  their  associated  signal  flow  paths. 

Each  of  the  three  Inertial  Sensor  Assemblies  contain  two  skewed  linear  accelerometers  and  two 
skewed  gyroscopes.  The  three  multipurpose  air  data  probes  are  able  to  sense  pilot  pressure  (Pj), 
static  pressure  (Ps),  and  angle-of-attack  (  a  ).  The  nose  mounted  air  data  probe  is  also  able  to  sense 
angle-of-sideslip  (0).  An  additional  method  of  sensing  0  is  through  sensing  the  difference  in  P$  on 
both  sides  of  the  fuselage.  The  two  total  temperature  (T-p)  probes,  one  on  each  side  of  the  fuselage, 
are  dualized  to  provide  two  fail-operational  performance  for  this  important  air  data  parameter. 

The  ISS  Inertial  and  Air  Data  Systems  (ADS)  provide  two  fail-operational  performance.  In  the  inertial 
sensor  sets  this  performance  level  is  obtained  through  the  use  of  skewed  gyroscopes,  and  skewed  ac¬ 
celerometers  (6  of  each),  and  failure  detection,  isolation,  and  reconfiguration  techniques.  The  ISS 
ADS  provides  the  same  two  fail-operational  performance  level  through  failure  detection,  isolation, 
and  analytical  redundancy  reconfiguration  techniques.  The  methods  of  obtaining  these  two  fail- 
operational  performance  levels  will  be  described  in  detail  later  on. 

ISS  SENSOR  SYSTEM  CONFIGURATIONS 

1.  ISS  Air  Data  System  Sensors,  Data  Handling  System,  and  Redundancy  Data  Management  System 

The  core  of  the  ISS  Air  Data  System  (ADS)  is  in  its  set  of  redundant  multipurpose  air  data  probes. 
Figure  3  shows  a  multipurpose  air  data  probe  configuration  capable  of  sensing  Pg,  Pj,  a  ,  and  0. 
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Figure  1.  Schematic  and  Signal  Flow  Diagram  of  the  ISS  Concept 


However,  because  of  its  hemispherical  nose  shape,  the  pitot  pressure  (Pj)  indications  are  a  function 
of  a  and  0.  With  accurate  position  error  corrections  within  the  digital  computer  complex,  true  in¬ 
dications  of  Pj  can  be  obtained. 


Figure  4  shows  the  hemispherical  sensor  head  of  the  multipurpose  air  data  probe  with  two  parts, 
labeled  Pc*-],  and  P^-  With  the  aircraft  at  a  equal  to  zero,  the  two  parts  sense  equal  pressures. 

At  positive  a,  the  pressure  at  the  lower  part  (Pa^)  becomes  greater  than  the  pressure  at  the  upper 
port  ( P a;^ ) •  The  greater  the  value  of  a  in  reference  to  the  relative  air  flow,  the  greater  the  pressure 
differential  between  the  two  ports,  a  can  be  computed  as  a  function  of  (P«i  —  P^)  for  either 
positive  or  negative  angles.  However,  this  pressure  differential  increases  with  increasing  dynamic 
pressure.  Therefore,  a  normalizing  function  must  be  introduced  to  account  for  changes  in  dynamic 
pressure  which  is  a  function  of  altitude  and  airspeed.  Normalization  techniques  for  a  and  j3  mea¬ 
surements  are  described  in  Reference  1. 


Additional  probe  errors  are  caused  by  local  pressure  disturbances  and  pressure  variations  at  each 
probe  location,  which  are  functions  of  airspeed,  Mach  no., a  ,  p,  and  the  variations  in  flow  geometry 
caused  by  flaps,  spoilers,  landing  gear,  and  control  surfaces. 


The  pressure  and  differential  pressure  outputs  of  the  air  data  probes  are  sent  to  pressure  transducers, 
as  shown  in  Figure  2,  via  short  pneumatic  tubing  runs  to  minimize  the  effect  of  transport  lag.  The 
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pressure  transducers  are  to  be  mounted  in  a  Universal  Transducer  Module  (still  in  the  development 
stage)  which  in  addition  to  pressure  transducers,  will  contain  a  microprocessor  for  preprocessing 
data  and  provide  data  output  control,  a  power  supply,  and  I/O  electronics.  The  pressure  trans¬ 
ducer  outputs  are  usually  non-linear  with  respect  to  ambient  pressure  and  input  pressure.  In  order 
to  correct  for  these  non-linearities,  the  microprocessor  will  compute  the  required  corrections  based 
upon  a  predetermined  set  of  linearization  coefficients  contained  within  each  pressure  transducer. 
After  linearization,  the  corrected  transducer  data,  under  microprocessor  control,  is  transmitted  by 
the  I/O  electronics  to  the  redundant  computer  complex  via  redundant  transmission  lines  as  shown  in 
Figure  2.  However,  the  linearized  air  data  parameters  transmitted  to  the  redundant  computer  com¬ 
plex  contain  probe  errors  due  to  local  pressure  disturbances  and  local  pressure  variations.  The  dif¬ 
ferential  pressures  for  a  and  0  must  also  be  corrected  as  functions  of  air  speed  and  altitude. 

In  order  to  show  the  nature  of  the  calculations  required  to  remove  these  probe  errors  a  signal  flow 
diagram  for  a  typical  analog  Central  Air  Data  Computer  (CADC)  is  shown  in  Figure  5.  The  diagram 
was  obtained  from  Reference  2. 

A  Data  Handling  System  (DHS)  is  integrated  within  the  ISS  Air  Data  System  to  perform  the  follow¬ 
ing  functions: 

•  Normalization  of  indicated  air  data  parameters. 

•  Redundancy  data  management. 

•  Air  data  computations. 

Normalization  is  a  multi-parameter  compensation  scheme  which  converts  the  linearized  pressure 
transducer  parameters  from  each  probe  location  into  useable  air  data  parameters  to  perform  the 
Redundancy  Data  Management  System  (ROMS)  functions  and  the  subsequent  air  data  calculations 
to  compute  airspeed,  altitude,  altitude  rate,  Mach  no.,  a  ,  0,  and  total  temperature.  The  local  flow 
characteristics  for  the  particular  aircraft  are  required  in  order  to  accurately  normalize  the  linearized 
pressure  data.  The  RDMS  within  the  DHS  performs  failure  monitoring,  failure  isolation,  and  signal 
selection.  In  addition,  through  the  use  of  analytical  redundancy,  a  fourth  channel  of  pressure  ratio, 
a  ,  and  0  are  derived  from  a  set  of  complementary  filters,  using  inertial  navigation  data  and  valid 
air  data  parameters.  Figure  6  outlines  the  methods  employed  by  the  RDMS  to  provide  a  two  fail- 
operational  level  of  performance.  The  outline  was  obtained  from  Reference  2.  Figure  7  is  a  block 
diagram  of  the  DHS.  Figure  8  is  a  block  diagram  of  the  RDMS  which  is  integrated  within  the  DHS. 

The  failure  monitoring  that  will  be  performed  by  the  RDMS  consists  of  two  types  as  shown  in 
Figure  8.  The  first  type  consists  of  a  reasonableness  test  in  which  the  latest  calculated  parameter  is 
compared  with  the  previously  calculated  parameter.  If  the  parameter  exceeds  the  failure  threshold 
a  transient  failure  is  declared,  and  the  associated  data  is  not  utilized  in  the  subsequent  calculations. 
The  failure  threshold  is  a  function  of  aircraft  dynamics  and  short  term  noise  characteristics  of  the 
calculated  parameter.  For  example,  the  threshold  associated  with  the  static  pressure  data  will  be  a 
function  of  the  maximum  change  in  altitude  of  the  aircraft,  plus  the  short  term  noise  character¬ 
istics  of  static  pressure  data  that  could  occur  between  successive  computation  cycles. 

The  second  type  of  failure  monitoring  performs  comparisons  between  channels  based  on  the  most 
current  data.  The  associated  failure  monitor  thresholds  will  be  functions  of  the  following: 

•  Probe-to-probe  reproducibility. 

•  Accuracy  and  repeatability  of  position  error  calibration. 

•  Air  data  transducer  accuracy. 


 -i  * 
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PNEUMATIC  TO  ELECTRICAL  COMPUTATION 


Figure  5.  Computational  Signal  Flow  in  a  Typical  Analog  Central  Air  Data  Computer  (CADC) 
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Figure  6.  Outline  of  Air  Data  Redundancy  Management  System  (RDMS)  Functions  (Sheet  2  of  2) 
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Figure  7.  Block  Diagram  of  the  Data  Handling  System  (DHS) 
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Figure  8.  Block  Diagram  of  the  Redundancy  Data  Management  System  (RDMS) 
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•  System  dynamic  response  errors. 

•  Errors  associated  with  analytical  redundancy  computations. 

Should  a  parameter  exceed  the  failure  threshold  for  a  specified  length  of  time,  a  permanent  failure 
is  declared. 

The  signal  selection  routines  in  the  DHS  control  the  sensory  data  which  will  be  utilized  to  determine 
the  "best  estimate"  for  each  air  data  parameter.  Should  a  transient  or  permanent  failure  occur,  the 
associated  sensory  data  is  not  utilized  in  the  "best  estimate"  computations. 

The  final  element  in  the  DHS  is  the  air  data  computations  which  utilize  the  "best  estimate"  sensory 
data  from  which  true  airspeed,  Mach  no.,  altitude,  a,  and  etc.  are  calculated  and  then  made  avail¬ 
able  to  the  using  subsystems  via  the  I/O  System  of  the  ISS. 

Table  1  shows  how  the  air  data  parameters  are  shared  among  the  using  subsystems. 

2.  ISS  Inertial  Data  System  Sensors,  Data  Handling  System,  and  Redundancy  Data  Management 
System 

The  ISS  Inertial  Data  System  uses  six  skewed  rate  gyros  and  six  skewed  linear  accelerometers  in  order 
to  obtain  a  two  fail-operational  performance  level  while  minimizing  the  number  of  sensors  and 
sensor  types  required.  The  six  linear  accelerometers  have  the  same  linear  acceleration  sensing  range 
and  the  six  gyros  have  the  same  angular  rate  sensing  range.  This  feature  minimizes  the  number  of 
sensor  types  required.  The  refinement  of  the  skewed  sensor  concept  was  advanced  by  the  Grumman 
Aerospace  Corporation  during  its  development  of  the  Advanced  Skewed  Sensory  Electronic  Triad 
(ASSET)  System  for  Flight  Control  (References  4  and  5).  The  ASSET  concept  was  successfully 
flight  tested  in  an  EA-6B  aircraft. 

The  ASSET  program  was  limited  to  the  development  of  skewed  rate  gyro  configurations.  No  effort 
was  expended  in  the  development  of  skewed  linear  accelerometer  configurations.  The  sensing  axis 
of  each  of  the  six  rate  gyros  were  skewed  in  a  manner  to  permit  sensing  of  components  of  pitch, 
roll,  and  yaw  rates  about  the  aircraft's  body  axes.  This  feature  permitted  the  development  of  rate 
gyro  configurations  that  provided  dual  fail-operational  capability  with  only  six  rate  gyros.  In  the 

Table  1.  Air  Data  Parameter  Requirements  Summary 
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conventional  approach  of  employing  four  rate  gyros  per  body  axis,  mounted  orthogonally,  twelve 
rate  gyros  are  required  to  obtain  dual  fail-operational  capability  (via  use  of  majority  voting  tech¬ 
niques).  Thus  the  ASSET  approach  permits  the  elimination  of  six  rate  gyros.  Figure  9  illustrates 
the  salient  features  of  both  the  conventional  and  the  ASSET  concepts. 

Figure  10  shows  the  geometry  of  the  sensing  or  input  axes  of  the  six  rate  gyros  which  are  oriented 
to  position  them  on  the  surface  of  a  cone,  with  the  cone  axis  oriented  along  the  aircraft's  Z  body 
axis.  The  central  half-angle  is  optimized  to  permit  the  use  of  rate  gyros  with  identical  sensing  range 
capability  despite  the  fact  that  the  maximum  rates  about  each  of  the  aircraft's  orthogonal  body 
axes  differ.  Other  criteria  for  cone  orientation  and  cone  central  half-angle  selection  are  to: 

•  Minimize  Analog-to-Digital  (A/D)  resolution  requirements. 

•  Minimize  the  average  total  error  amplification  due  to  skewing. 

•  Retain  the  quantization  necessary  to  satisfy  FCS  and  Strapdown  Attitude  and  Heading 
Reference  System  (SAHRS)  requirements. 

With  careful  selection  of  the  cone  central  half-angle,  based  on  the  knowledge  of  the  maximum  rate 
requirements  of  the  aircraft,  it  is  possible  to  maintain  the  accuracy  of  the  cone  configuration  equiv¬ 
alent  to  that  of  the  conventional,  orthogonally  mounted,  3-axis  rate  gyro  package.  In  Figure  10  the 
apex  of  the  cone  is  pointed  forward.  It  may  also  be  pointed  rearward  as  shown  in  Figure  1. 

The  rate  sensed  by  each  gyro  is  a  function  of  the  following: 

•  Gyro  orientation  angle 

•  Gyro  central  half-angle 

•  Rates  about  the  aircraft  body  axes 

•  Rates  induced  by  the  fuselage  bending  modes  and  the  vibrations  and  bending  modes  of  the 
mounting  bulkhead 

The  following  equation,  in  matrix  form,  describes  the  actual  signal  from  each  rate  gyro: 
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CKq  =  to  the  gyro  orientation  angle 

pq  =  to  the  gyro  central  half-angle 
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14 


X 

t-  s* 

£  1 
in  CC 

<  a* 


z  ° 

>  a. 
Z  «t 
o 
cj 


Figure  9.  Rate  Gyro  Configurations  for  Dual  Fail-Operational  Capability 
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Figure  10.  Geometry  of  Rate  Gyro  Sensing  Axes  for  the  ASSET  Concept 


ojj  =  to  the  rate  sensed  by  the  ith  gyro  (i  =  1  to  6) 
=  to  the  total  rate  about  Z  axis 
ouy-p  =  to  the  total  rate  about  Y  axis 
ojx-j.  =  to  the  total  rate  about  X  axis 


(See  Figure  1 1  for  the  geometry  of  the  skew  angles) 


ojz.p  coy-p  and  ^xj,  are  a  function  of  aircraft  body  axes  rates,  fuselage  bending,  and  bulkhead 
bending  and  vibrations.  The  errors  introduced  by  the  structural  bendings  and  vibrations  are  removed 
by  the  ISS  Inertial  Sensor  Data  Handling  System  and  the  true  values  of  the  aircraft  rigid  body  axes 
rates  ojz,  ojy,  and  cux  are  made  available  to  the  FCS  and  for  attitude  and  heading  computations. 
These  tasks  are  performed  in  the  digital  computer  complex  with  the  true  values  of  the  aircraft's 
body  rates  being  updated  at  the  rate  of  about  50  iterations  per  second. 

The  ISS  inertial  sensor  set  utilizes  six  skewed  linear  accelerometers  of  which  the  input  or  sensing 
axes  form  a  cone  surface  oriented  along  the  aircraft's  Z  body  axis  as  shown  in  Figure  1.  The  criteria 
for  cone  orientation  and  cone  half-angle  selection  are  the  same  as  those  for  the  skewed  rate  gyros. 


Figure  1 1.  Geometry  of  a  Conical  Array  of  Six  Rate  Gyros 


The  linear  acceleration  sensed  by  each  accelerometer  is  a  function  of  the  following: 

•  Accelerometer  orientation  angle. 

•  Accelerometer  central  half  angle. 

•  Acc  derations  along  the  body  axes. 

•  Length  of  moment  arm  from  c:rcraft  C.G.  to  the  accelerometer. 

•  Length  of  moment  arm  from  center  of  rotation  of  the  bulkhead  to  the  accelerometer. 

•  Aircraft  angular  rates  and  angular  accelerations  about  the  body  axes. 

•  Flexing  and  bending  mode  characteristics  of  the  mounting  bulkhead  and  fuselage. 

The  following  equation,  in  matrix  form,  describes  the  actual  signal  from  each  linear  accelerometer: 
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Equation  2 
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where: 


4>a  =  to  the  accelerometer  orientation  angle 

|5a  =  to  the  accelerometer  central  half-angle 

aj  =  to  the  linear  acceleration  sensed  by  the  ith  accelerometer  (i  =  1  to  6) 


aVT 

"XT 


=  to  the  total  acceleration  along  the  Z  axis 
=  to  the  total  acceleration  along  the  Y  axis 
=  to  the  total  acceleration  along  the  X  axis 


(See  Figure  12  for  the  geometry  of  the  skew  angles) 


dzy,  dyy,  and  dxy  are  functions  of  accelerations  along  the  aircraft  body  axes,  aircraft  angular  rates 
and  angular  accelerations  about  the  body  axes,  and  flexing  and  bending  mode  characteristics  of  the 
mounting  bulkhead  and  fuselage.  The  errors  introduced  in  these  terms  are  removed  by  the  DHS 
and  the  true  values  of  dx,  ay/  and  az  are  made  available  to  the  FCS,  SAHRS,  and  other  using  sub¬ 
systems  at  the  rate  of  about  50  iterations  per  second. 


The  rate  gyros  and  the  linear  accelerometers  of  an  ISS  are  dispersed  in  order  to  enhance  its  surviv¬ 
ability  in  combat  operations.  Rate  gyro  and  linear  acceleration  information  used  for  self-contained 
failure  detection  and  isolation,  flight  control  feedback  and  for  attitude  reference  purposes  must  be 
adjusted  to  account  for  rigid  body  aircraft  motion  (about  the  center  of  gravity)  and  flexible  fuselage 


i. 


Figure  12.  Geometry  of  a  Conical  Array  of  Six  Linear  Accelerometers 
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and  bulkhead  motions.  Centripetal  and  tangential  acceleration  "errors”  that  arise  from  rigid  and 
flexible  body  motion  must  be  "normalized"  or  removed  from  the  outputs  of  hard  mounted  linear 
accelerometers  (located  off  of  the  C.G.)  before  the  information  is  used  for  failure  detection  and 
isolation,  flight  control  functions  or  as  inputs  to  the  SAHRS. 

With  flexible  inputs  not  removed  from  the  rate  gyro  outputs  prior  to  entering  the  SAHRS  routines, 
the  indicated  attitude  will  reflect  flexible  body  as  well  as  rigid  body  motion. 

To  minimize  errors  in  estimating  the  centripetal  (co^r)  and  tangential  (r  u>)  accelerations  for 
SAHRS  data,  the  concept  of  a  virtual  NAV-BASE  and  digital  bending  filter  incorporated  within  the 
DHS,  was  developed.  The  virtual  NAV-BASE  eliminates  the  requirements  for  accurately  locating 
the  linear  accelerometers  with  respect  to  the  C.G.  of  the  aircraft.  The  digital  bending  filter  allows 
differing  bending  inputs,  sensed  by  the  dispersed  linear  accelerometers,  to  be  precisely  removed  with 
minimum  effect  in  system  bandwidth.  For  flight  control  usage,  these  acceleration  data,  referenced 
to  a  virtual  NAV-BASE,  are  then  "translated"  to  the  C.G.,  or  to  any  other  location  in  the  aircraft 
that  satisfies  control  law  requirements  (i.e.,  under  the  cockpit  for  ride  control). 

Table  2  (obtained  from  Reference  1)  lists  the  adjustments  required  to  account  for  rate  gyro  and 
linear  accelerometer  dispersion. 

Figure  13  shows  a  block  diagram  of  the  ISS  Inertial  Sensor  Data  Handling  System  (DHS)  which  is 
imbedded  as  software  in  the  digital  computer  complex. 

Inputs  to  the  DHS  are  provided  by  the  six  rate  gyros  and  the  six  linear  accelerometers.  The  signal 
flows  from  the  rate  gyros,  their  normalization,  redundancy  management,  and  subsequent  distribu¬ 
tion  will  be  described  first. 


Table  2.  Adjustments  Required  to  Account  for  Rate  Gyro  and  Linear  Accelerometer  Dispersion 
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The  inputs  to  the  skewed  rate  gyros  are  the  rigid  body  axes  rates  (p,  q,  r)  and  the  undesired  fuselage 
and  bulkhead  bending  rates.  Equation  1  is  the  rate  gyro  skew  matrix.  The  six  simultaneous  linear 
equations  are  solved  at  the  iteration  rate  of  approximately  50  times  per  second  to  obtain  updated 
values  of  cuxj.  wyj<  and  wzy  Extrapolated  fuselage  and  bulkhead  bending  rate  estimates  from 
the  State  Estimator  are  subtracted  or  filtered  from  cuxt-  tuy-p  anc*  <^zy  and  the  resultant  values 
are  used  to  aid  in  the  rate  gyro  normalization  process.  The  angular  rates  sensed  by  each  rate  gyros 
input  axis  (ou-j,  cug,  cj 4 ,  cug,  cog)  are  also  sent  to  the  Rate  Gyro  Normalization  Routine  for 
filtering.  The  filtered  values  are  used  as  an  aid  in  the  failure  detection  processes,  and  calculation  of 
p,  q,  and  r,  and  are  inputed  to  the  Rate  Gyro  RDMS  (See  Figure  14).  Imbedded  within  the  Rate 
Gyro  RDMS  are  the  following  routines: 

•  Transient  Failure  Removal  Routine  (TFRR) 

•  Sensor  Voting  Selection  Routine  (SVSR) 

•  Failure  Isolation  Computation  Routine  (FICR) 

The  Transient  Failure  Removal  Routine  (TFRR)  accepts  four  types  of  inputs.  These  are  as  follows: 

( 1 )  Rate  gyro  output  signals. 

(2)  Estimated  rate  gyro  outputs. 

(3)  Failure  Isolation  Computation  Routine  (FICR)  failure  signal. 

(4)  In-flight  BIT  (IFBIT)  failure  signal. 

Each  rate  gyro  (after  filtering)  furnishes  an  output  signal  corresponding  to  the  angular  rate  applied 
about  its  input  axis.  The  maximum  rates  expected  from  each  rate  gyro  depends  on  the  cone  half¬ 
angle  and  on  the  maximum  roll,  pitch,  and  yaw  angular  rate  capabilities  of  the  aircraft.  The  estimated 
outputs,  one  for  each  rate  gyro,  are  available  from  FICR  computations  carried  out  during  the  prev¬ 
ious  iteration.  Whenever  a  rate  gyro  output  is  unacceptable  for  a  sufficient  period  to  establish  it  as 
permanently  failed  the  FICR  makes  the  information  available  to  the  TFRR  so  that  the  failed  rate 
gyro  is  not  included  in  any  future  calculations. 

During  every  iteration  each  rate  gyro  output  signal  is  subtracted  from  the  estimated  output.  The 
difference  is  compared  with  the  threshold  corresponding  to  each  rate  gyro.  If  this  difference  is  less 
than  the  threshold  the  output  signal  is  changing  at  an  acceptable  rate  and  the  rate  gyro  is  considered 
to  have  no  temporary  failure.  If  the  difference  is  greater  than  the  threshold  the  rate  gyro  is  classi¬ 
fied  as  temporarily  failed  and  a  signal  is  made  available  to  notify  the  Sensor  Voting  Selection  Routine 
(SVSR)  and  the  FICR.  The  signal  also  identifies  which  rate  sensor  has  failed. 

The  SVCR  produces  satisfactory  estimates  of  the  angulo.  .  Jtes  about  the  roll,  pitch,  and  yaw  axes  of 
the  aircraft.  The  voting  subroutines  (i.e.,  VOTE  6,  VOTE  5,  VOTE  4,  and  VOTE  3)  which  compute 
the  angular  rates  are  selected  on  the  basis  of  the  failure  state. 

When  there  are  no  failures,  the  six  rate  gyro  outputs  exceed  the  number  required  to  obtain  satisfac¬ 
tory  values  of  p,  q,  and  r.  To  minimize  computational  resource  requirements  VOTE  6  has  been  de¬ 
signed  to  select  4  rate  gyros,  using  parity  equations,  so  that  the  error  in  the  estimate  of  aircraft  rates 
is  minimized.  To  eliminate  the  first  rate  gyro  these  equations  compare  each  rate  gyro  output  with 
the  estimated  value  of  its  output,  obtained  from  the  other  three  rate  gyros.  The  rate  gyro  output 
which  deviates  most  from  its  estimated  value  is  not  used  in  the  calculation  of  p,  q,  and  r.  The  addi¬ 
tional  rate  gyro  is  removed  by  selecting  a  favorable  configuration  that  minimizes  the  error  in  the 
rate  output. 
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When  one  sensor  has  been  classified  as  a  failure,  VOTE  5  selects  the  best  four  of  the  remaining  five 
by  the  use  of  parity  equations.  With  two  failures  no  choice  of  rate  gyros  that  would  decrease  roll, 
pitch,  and  yaw  error  is  possible  and,  therefore,  the  four  remaining  are  used  to  compute  the  angular 
rates  in  VOTE  4. 

The  occurrence  of  three  failures  leaves  only  three  rate  gyro  outputs  available  to  calculate  p,  q,  and  r 
in  VOTE  3.  Linder  this  condition  a  warning  signal  is  generated  to  inform  the  pilot  of  the  potential 
danger. 

Descriptions  of  the  computational  processes  of  the  four  VOTE  subroutines  are  contained  in  Appendix 
2  of  Reference  4. 

The  Failure  Isolation  Computational  Routine  (FICR)  detects  and  identifies  rate  gyros  which  have 
permanently  failed.  Two  ways  of  examining  for  permanent  failures  are  used.  First,  if  any  of  the 
rate  gyro  estimated  outputs  exceed  5  degrees  per  second,  the  error  of  those  rate  gyros  are  examined 
using  a  Cross  Voter  Comparison  Monitoring  (CVCM)  technique  while  the  other  rate  gyros  are  not 
tested.  If  all  of  the  rate  gyro  estimated  outputs  are  less  than  5  degrees  per  second  the  errors  from 
all  of  the  rate  gyros  are  estimated  using  a  Cross  Channel  Comparison  Monitoring  (CCCM)  technique. 

Using  the  CVCM  technique,  the  values  of  the  p,  q,  and  r  rates  produced  by  the  SVCR  are  used  to 
generate  estimates  of  the  six  rate  gyro  outputs.  The  individual  estimates  of  the  outputs  are  then 
divided  by  the  actual  rate  gyro  outputs.  If  the  absolute  value  of  (dividend  -  1.0)  is  the  largest  of  all 
being  examined  and  greater  than  a  threshold  for  a  period  of  0.2  seconds,  the  rate  gyro  is  classified 
as  a  permanent  failure. 

With  the  CCCM  technique,  used  when  the  rate  gyro  outputs  are  less  than  5  degrees  per  second,  the 
error  of  a  rate  gyro  is  estimated  by  means  of  one  of  a  set  of  fifteen  equations  (called  "parity  equa¬ 
tions")  which  are  defined  and  described  in  Reference  4.  Briefly  the  fifteen  parity  equations  describe 
the  relationships  between  all  possible  groups  of  four  rate  gyros  selected  from  the  six  in  the  skew 
arrangement. 

When  the  parity  equations  are  all  equal  to  zero  the  rare  gyro  outputs  are  error  free.  However,  an 
equation  not  equal  to  zero  indicates  an  error  and  a  possible  permanent  failure.  If  the  error  persists 
continuously  for  at  least  1  second,  the  rate  gyro  producing  the  error  is  classified  as  permanently 
failed. 

With  no  permanent  failures  subroutine  FICR  6  is  used.  With  one  permanent  failure  subroutine  5  is 
used.  When  none  or  one  previous  permanent  failure  exists,  the  next  permanent  failure  can  be  ident¬ 
ified  by  the  parity  equations.  With  two  permanent  failures  (FICR  4),  the  parity  equations  indicate 
that  one  of  the  four  remaining  rate  gyros  is  a  permanent  failure  but  it  cannot  identify  the  one  that 
has  failed. 

The  FICR  subroutines  are  defined  and  described  in  detail  in  Reference  4. 

Existing  outside  the  functional  boundaries  of  the  RDMS,  the  IFBIT  detects  catastrophic  (permanent) 
failures  of  the  rate  gyros.  The  IFBIT  output  furnishes  information  that  a  rate  gyro  has  failed  and 
its  identity. 

The  inputs  to  the  skewed  linear  accelerometers  are  the  point  mass  accelerations,  and  the  undesired 
rotational,  fuselage  and  bulkhead  bending  accelerations.  Equation  2  is  the  linear  accelerometer  skew 
matrix.  The  six  simultaneous  linear  equations  are  solved  at  the  iteration  rate  of  approximately  50 
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times  per  second  to  obtain  updated  values  of  aXy,  ayy,  and  azj ■  Extrapolated  fuselage  and  bulk¬ 
head  bending  accelerations  and  rotational  accelerations  from  the  State  Estimator,  and  the  p,  q,  and 
r  angular  rates  from  the  Rate  Gyro  RDMS  are  used  to  remove  the  errors  in  aXy,  ayy,  and  azy  and 
the  resultant  values  are  used  to  aid  in  the  linear  accelerometer  normalization  process.  The  linear 
accelerations  (ay  a2<  ag,  a^,  ag,  a^),  sensed  by  each  linear  accelerometer,  are  sent  to  the  Linear 
Accelerometer  Normalization  Routine  for  filtering.  The  filtered  values  are  used  as  an  aid  in  the 
failure  detection  and  isolation  process,  and  the  calculation  of  ax,  a y,  az,  and  are  inputed  to  the 
Linear  Accelerometer  RDMS  (see  Figure  15).  The  calculation  processes,  logic,  and  sfgnal  flow  are 
the  same  as  those  for  the  Rate  Gyro  RDMS. 

The  State  Estimator  of  the  ISS  Inertial  Sensor  DHS  is  used  to  calculate  an  estimate  of  the  aircraft's 
fuselage  and  bulkhead  bending  rates  and  accelerations  as  well  as  the  kinematic  accelerations  at  the 
dispersed  sensor  locations.  The  estimates  of  bending  and  kinematic  effects  are  then  subtracted  from 
the  raw  sensor  data  to  permit  effective  failure  detection  and  isolation  and  accurate  calculation  of 
the  aircraft's  orthogonal  angular  rates  and  linear  accelerations. 

State-of-the-art  digital  design  techniques  were  applied  by  the  Grumman  Aerospace  Corporation  to 
develop  the  State  Estimator.  Reference  6  describes  the  development  and  functions  of  the  State 
Estimator. 

3.  ISS/SAHRS  Function  for  Sensing  Attitudes,  Heading,  and  Inertial  Velocity  Components 

A  Strapdown  and  Heading  Reference  System  (SAHRS)  is  integrated  within  the  ISS  for  the  calcula¬ 
tion  of  the  following  parameters  using  corrected  values  of  p,  q,  and  r  and  ax,  ay,  and  az  and  inputs 
from  non  ISS  sensors: 

•  Roll  altitude  (  ) 

•  Pitch  altitude  (  9  ) 

•  Heading  altitude  ( 4*  ) 

•  North  component  of  velocity 

•  East  component  of  velocity 

•  Vertical  component  of  velocity 

Corrected  values  of  the  p,  q,  and  r  angular  rates,  obtained  from  the  ISS  Inertial  Sensor  DHS  are  inte¬ 
grated  once  and  processed  to  obtain  the  Euler  Angles  <1>,  9,  and  'I'.  The  corrected  values  of  ax, 
ay,  and  az  orthogonal  linear  accelerations,  also  obtained  from  the  DHS,  are  integrated  once  to  ob¬ 
tain  the  inertial  velocity  components  along  the  aircraft  body  axes  and  thse  values  together  with  the 
Euler  Angles  are  used  to  obtain  the  North,  East,  and  Vertical  inertial  velocity  components.  The  inte¬ 
grated  values  of  these  velocity  components  are  used  to  calculate  position  changes  for  navigational 
purposes. 

The  outputs  of  the  ISS/SAHRS  are  used  by  the  following  aircraft  systems: 

•  Flight  Control  System  (FCS) 

•  Automatic  Flight  Control  System  (AFCS) 

•  Cockpit  displays 

•  Weapons  delivery 
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INPUTS  FROM  LINEAR  ACCELEROMETER  NORMALIZATION 
ROUTINE  (FILTERED  3j,  a^,  3^,  3g,  3g) 


Figure  15.  Linear  Accelerometer  Redundancy  Data  Management  System  (RDMS) 
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Figure  16  shows  the  ISS/SAHRS  Signal  Flow  Block  Diagram.  The  skewed  rate  gyro  and  linear 
accelerometer  data  are  resolved  by  the  ISS  Inertial  Sensor  DHS,  to  three  outputs  along  vehicle  axes. 
Spurious  inputs  from  aircraft  rigid  body  and  flexible  body  motions,  coupled  with  the  dispersion  of 
skewed  vector  sensors,  are  removed  by  the  DHS. 

After  initialization  of  the  inertial  frame  to  vertical  and  north  the  Attitude  Transformation  Update 
and  Orthonormalization  Routine  operates  on  the  rate  gyro  outputs  to  maintain  the  knowledge  of 
the  angular  relationship  between  the  aircraft  body  and  inertial  frame.  This  angular  relationship  is 
used  to  transform  the  linear  accelerometer  data  obtained  along  the  body  axis  to  the  vertical.  The 
information  is  then  mixed  with  "aiding"  data  such  as  air  data  velocity,  to  "erect"  the  system  through 
a  long-time-constant  filter  to  the  vertical.  Therefore,  the  long-term  accuracy  of  the  vertical  indica¬ 
tion  depends  on  the  accuracy  of  the  reference  velocity.  The  reference  frame  is  "slaved"  to  north, 
defined  by  the  magnetic  heading  information,  again  through  a  long-time-constant  filter. 

Relative  velocity  and  relative  position  (range  and  range  rate)  can  be  obtained  from  this  system  when 
the  system  is  aided  with  relative  position  data  from  a  landing  guidance  sensor  such  as  those  described 
in  Reference  7. 


Alignment  on  the  ground  and  in  flight  will  be  performed  in  two  steps: 

•  Coarse  Alignment  —  where  one  or  two  iterations  of  the  magnetic  heading  and  accelerometer 
data  are  used  to  generate  a  crude  estimate  of  attitude  and  heading  (body  axes  orientation  with 
respect  to  vertical  and  north).  After  this  is  completed,  the  system  reverts  to  Fine  Alignment. 

•  Fine  Alignment  —  is  composed  of  a  40-sec  time  constant,  second-order  vertical  erection  loop 
that  uses  reference  velocity,  and  a  10-sec  time  constant,  second-order  heading  filter  that  uti¬ 
lizes  magnetic  heading  information. 

Attitude  transformation  presents  one  of  the  most  demanding  requirements  on  the  throughput  of  a 
digital  computation  system.  Studies  utilizing  the  information  in  Reference  8  have  shown  that  a  50 
msec  update  rate  using  a  second-order  quaternion  algorithm  will  be  satisfactory  for  SAHRS  per¬ 
formance.  Typically,  at  a  300  deg/sec  roll  rate  input  the  computational  error  is  approximately  0.04 
degrees  per  iteration.  Subsection  3.4  of  Reference  2  shows  that  this  SAHRS  50  msec  update  rate 
will  satisfy  ISS  computational  requirements. 


The  results  of  the  SAHRS  performance  analysis  and  an  equipment  survey  showed  that  in-production 
Single- Degree-Of- Freedom  (SDOF)  rate  integrating  gyros  in  the  12,000  to  30,000  gm-cm/sec  angular 
momentum  class  and  in-production  linear  accelerometers  with  self-contained  loop  electronics  will 
satisfy  the  performance  requirements  of  an  ISS. 


Typical  rate  gyro  performance  requirements  for  an  ISS/SAHRS  are  listed  as  follows: 


•  Random  drift 

•  Start/start  bias  repeatability 

•  G  sensitivity  drift  repeatability 

•  Anisoelasticity 

•  Compensated  temperature  sensitivity 

•  Wheel  run-up  time 

•  Scale  factor  linearity 


0.20  deg./hr.  ( 1o  ) 
0.20  deg./hr.  ( la  ) 
0.20  deg./hr./g  (la  ) 
0.50  deg./hr./g^ 
0.006  deg./hr./°C 
3  seconds 
200  PPM 

(parts  per  million) 


Figure  16.  ISS/SAHRS  Signal  Flow  Block  Diagram 
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Overall  SAHRS  performance  and  accuracy  requirements  are  listed  as  follows: 

•  Magnetic  Heading  0.5  degree  (1o  ) 

•  Pitch  0. 1 5  degree  ( 1  a  ) 

•  Roll  0. 1 5  degree  ( 1  a  ) 

•  Body  rates  0.5% 

•  Linear  acceleration  0.005  g 

(Note:  The  above  performance  and  accuracy  values  are  attained  by  the  Sperry  SRS-1 100  SAHRS) 

The  performance  requirements  for  the  ISS/SAHRS  inertial  sensors  are  dictated  by  the  accuracies 
required  for  inputs  to  the  FCS  of  a  VTOL  type  aircraft  designed  to  land  on  small  ship  platforms 
during  adverse  weather  and  sea  state  conditions. 

ISS  REDUNDANT  INPUT/OUTPUT  (I/O)  SYSTEM 

The  redundant  and  dispersed  Input-Output  (I/O)  system  is  the  element  of  the  ISS  concept  that 
links  the  data  from  the  redundant  sensor  set  to  the  using  systems  via  a  redundant  digital  computer 
complex.  To  reduce  vulnerability  to  combat  damage  the  I/O  system  signal  paths  are  redundant  and 
dispersed.  Figure  17  is  a  simplified  signal  flow  and  block  diagram  of  an  ISS  I/O  system  for  a  DFCS. 

It  represents  only  one  of  the  many  methods  in  which  an  I/O  system  may  be  configured.  Flight 
safety  critical  inputs  to  the  digital  Flight  Control  Computer  (FCC)  complex  are  transmitted  via 
redundant  and  dedicated  signal  paths.  Output  signals  from  the  FCC's  to  flight  safety  critical  signals 
are  transmitted  in  the  same  manner.  Signals  from  the  FCC's  to  systems  which  can  be  in  a  failed 
state  without  degrading  the  controllability  of  the  aircraft  are  transmitted  via  the  Dualized  Avionics 
Multiplex  Bus. 

Note  that  the  outputs  of  the  Air  Data  Sensors,  which  are  in  the  digital  format,  are  inputed  into  the 
FCC's  via  dedicated  triplex  multiplex  bus  signal  paths.  Figure  18  shows  this  interface  in  greater 
detail.  Each  of  the  three  Universal  Transducer  Modules  shown  contain  a  microprocessor  for  pre¬ 
processing  the  air  sensor  data  and  to  provide  data  output  control,  a  power  supply,  and  the  I/O  elec¬ 
tronics  necessary  to  interface  with  the  redundant  multiplex  buses.  Since  the  air  data  values  are  in 
digital  form  in  the  microprocessors  their  transmission  to  the  FCC's  can  be  most  efficiently  accom¬ 
plished  via  multiplex  buses. 

The  other  flight  safety  critical  inputs  to  the  FCC's  shown  in  Figure  17  are  in  the  analog  format  and 
are  converted  to  the  digital  format  in  the  FCC's. 

For  all  inputs  the  functions  of  failure  detection,  failure  isolation  and  signal  selection  are  performed 
in  the  FCC's.  Signal  outputs  from  the  FCC's  to  the  flight  safety  critical  systems  (after  undergoing) 
D/A  conversion)  are  in  the  analog  format. 

Methods  of  inputting  the  critical  ISS  inertial  sensor  data  to  the  FCC's  will  now  be  described.  The 
most  reliable  method  is  that  of  ''cross-strapping''  the  output  of  each  inertial  sensor  to  all  three  FCC's 
as  shown  in  Figure  19.  The  inertial  sensors  are  housed  in  three  Inertial  Component  Assemblies 
(ICA's).  Each  ICA  contains  two  skewed  single  degree-of-freedom  (SDOF)  rate  gyros  and  two  skewed 
linear  accelerometers.  The  ICA's  are  widely  dispersed  and  mounted  on  one  fuselage  bulkhead  to 
reduce  the  vulnerability  of  the  ISS  inertial  sensors  set  to  combat  damage.  Loss  of  an  ICA  will  not 
prevent  the  FCC's  to  output  corrected  values  of  p,  q,  r,  ax,  ay,  and  az  to  the  using  systems.  The 
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losses  of  two  like  sensors  (two  rate  gyros  and/or  two  linear  accelerometers  cai  be  readily  compen¬ 
sated  for  by  the  ROMS  of  the  ISS  Inertial  Sensor  DHS. 

The  output  signals  of  the  inertial  sensors  are  in  the  analog  format  and  the  required  A/D  conversions 
are  performed  in  the  FCC's.  Note  that  each  FCC  has  twelve  dedicated  input  ports  to  receive  the 
inertial  sensor  signals.  For  each  input  port  there  is  a  dedicated  A/D  converter.  It  is  readily  apparent 
that  the  cross-strapping  method  is  costly  in  terms  of  system  Life  Cycle  Costs  (LCC),  hardware  parts 
count,  and  weight. 

Cross-strapping  is  used  in  the  quadruplex  DFCS  of  the  F-18.  To  attain  two  fail-operational  per¬ 
formance  the  DFCS  utilizes  four  FCC's,  twelve  rate  gyros,  and  twelve  linear  accelerometers  (four 
sensors  per  axis).  The  axes  of  the  F-18  inertial  sensors  are  orthogonal.  Each  FCC  has  twenty-four 
dedicated  input  ports  to  receive  the  analog  signals  of  the  twelve  rate  gyros  and  twelve  linear  accel¬ 
erometers.  In  contrast  an  ISS  concept  using  cross-strapping  requires  half  as  many  input  ports  (12 
vs.  24)  to  obtain  two  fail-operational  performance. 


A  less  costly  method  of  inputing  inertia  sensor  signals  is  shown  in  Figure  20.  The  output  of  each 
inertial  sensor  (in  the  analog  format)  is  sent  to  only  one  of  the  FCC's  and  then  transmitted  to  the 
other  two  FCC's  via  the  inter  computer  high  speed  data  link.  Since  each  FCC  receives  data  from  all 
inertial  sensors  all  FCC's  are  able  to  perform  the  ISS  Inertial  Sensor  DHS  function.  Note  that  each 
FCC  now  requires  only  four  dedicated  input  ports  and  A/D  converters.  This  method  of  inputing 
inertial  sensor  data  to  the  FCC's  is  employed  in  the  triplex  DFCS  of  the  AFT1/F-16  aircraft. 
Studies  conducted  by  the  General  Dynamics  Corporation  have  shown  that  this  method  is  less  costly 
than  cross-strapping  with  only  a  small  decrease  in  reliability. 
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In  some  future  DFCS  configurations  it  might  be  desirable  not  to  burden  the  FCC's  with  the  ISS 
Inertial  Sensor  DHS  function.  This  burden  could  be  placed  upon  a  network  of  distributed  micro¬ 
processors  (  /up's)  configured  as  shown  in  Figure  21.  Each  inertial  sensor  output  signal  is  sent  to 
only  one  input  port  of  a  Atp  and  then  transmitted  to  the  other  two  Aip's  via  an  inter  computer 
high  speed  data  link.  The  outputs  of  the  three  ICA  Aip's  are  corrected  values  of  p,  q,  r,  a x,  ay, 
and  which  are  inputted  to  the  three  FCC's. 

ISS  COMPUTATION  NETWORKS  WITHIN  REDUNDANT  DIGITAL  COMPUTER  COMPLEXES 


The  use  of  the  ISS  concept  in  aircraft  with  DFCS's  does  not  impose  the  requirement  for  the  develop¬ 
ment  and  procurement  of  dedicated  or  special  purpose  digital  computers.  This  course  of  action 
would  be  most  undesirable  as  it  would  greatly  increase  the  Life  Cycle  Costs  (LCC)  of  operational 
aircraft  integrated  with  an  ISS.  The  required  computations  for  an  ISS  may  be  performed  in  digital 
computer  architectures  listed  as  follows: 

(a)  Use  of  available  on-board  redundant  FCC's  on  a  time  shared  basis. 

(b)  Use  of  a  computational  architecture  containing  both  redundant  distributed  microprocessors 
and  redundant  FCC's  on  a  time  shared  basis.  The  microprocessors,  dedicated  for  ISS  func¬ 
tions,  would  reduce  the  computational  load  of  the  FCC's. 


INTER  COMPUTER  HIGH  SPEED 


OUTPUT'S 

OF 

FCC'S  TO 
USING 
SYSTEMS 


•CORRECTED  VALUES  OF  wx.  ujy,  w7,  ax,  ay,  AND  az 


Figure  21.  Interface  of  the  Inertial  Component  Assemblies  and  ICA  a<p's  with  the  Flight 
Control  Computers 
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THE  ADVANCED  FIGHTER  TECHNOLOGY  INTEGRATOR  (AFTI/F-16) 
DEVELOPMENT  AND  INTEGRATION  PROGRAM 


The  purpose  of  the  Advanced  Fighter  Technology  Integrator  (AFTI/F-16)  Program  is  to  design, 
develop,  and  integrate  into  a  modified  F-16  aircraft,  a  set  of  advanced  technologies  capable  of  pro¬ 
viding  improved  weapon  system  effectiveness  and  survivability  in  air-to-air  and  air- to- surf  ace 
The  set  of  technologies  to  be  designed,  developed,  integrated,  and  verified  by  flight  tests  in  an 
AFTI/F-16  aircraft  are  listed  as  follows: 

•  Advanced  Digital  Flight  Control  System  (DFCS) 

•  Advanced  Integrated  Fire  and  Flight  Control  (IFFC)  System 

•  Advanced  Armament/Weapon  Delivery  System 

•  Aerodynamic  Optimization 

•  Advanced  Crew  Stations  Systems  and  Concepts 

Figure  22  summarizes  the  objectives  of  the  AFTI/F-16  Program. 

The  AFTI/F-16  Program  is  being  sponsored  and  funded  by  the  Air  Force,  Navy,  and  NASA.  The 
prime  contractor  is  the  General  Dynamics  (GD)  Corp ./  Fort  Worth  Division.  The  Navy  is  providing 
part  of  the  funding  and  program  direction  for  only  one  of  the  set  of  technologies  being  developed; 
the  advanced  Digital  Flight  Control  System  (DFCS).  Only  the  design  and  development  of  this  tech¬ 
nology  will  be  described  in  this  report.  However  aircraft  subsystems  interfacing  with  the  DFCS  will 
also  be  described.  The  subcontractor  for  the  design,  development,  and  fabrication  of  the  main 
components  of  the  DFCS  is  the  Flight  Systems  Division  of  the  Bendix  Corporation  located  at 
Teterboro,  New  Jersey. 

The  general  objectives  of  the  AFTI/F-16  DFCS  Advanced  Development  Program  are  as  follows: 

•  Demonstrate  the  operation  of  a  second  generation  DFCS. 

•  Evaluate  the  operational  capabilities  of  a  triplex  DFCS. 

•  Demonstrate  the  benefits  of  multi-mode  flight  control  capability. 

•  Determine  the  configuration  of  an  independent  flight  control  backup  system. 

•  Evaluate  pilot  acceptance  of  Direct  Lift  Control  (DLC),  Direct  Side-Force  Control  (DSF) 
and  fuselage  pointing  capabilities. 

•  Demonstrate  increased  mission  effectiveness  and  reduced  pilot  workload. 

•  Develop  a  data  base  and  experience  for  future  DFCS  applications. 

Some  of  the  more  specific  objectives  are  as  follows: 

•  Define  computer  characteristics 
—  Architecture 

—  Throughput  requirements 
—  Memory  requirements 


INTEGRATE  \m\  DEMONSTRATE  \m\  USE 
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•  Evaluate  redundancy  data  management  for  dual  fail-operational  (F/0)  capability. 

•  Evaluate  confidence  level  of  in-line  testing. 

•  Define  independent  backup  flight  control  switching  intelligence. 

•  Define  1553  Multiplex  Bus  interfaces. 

•  Confirm  multi-mode  selection 
-  Normal 

—  Air-to-air 

—  Air-to-ground  strafing 
—  Air-to-ground  bombing. 


DESCRIPTION  OF  THE  AFTI/F-16  DIGITALFLIGHT  CONTROL  SYSTEM  (DFCS) 

The  AFTI/F-16  Digital  Flight  Control  System  (DFCS)  is  a  full  Fly-By-Wire  (FBW)  system  with  no 
provision  for  mechanical  back-up.  Advanced  digital  computational  technology,  electronic  mechani¬ 
zation,  and  control  theory  are  used  to  eliminate  mechanical  type  input  signal  paths  in  all  axes.  From 
Figure  23  it  is  evident  that  no  mechanical  linkages  or  control  cables  are  used  between  the  cockpit 
controllers  (side-stick,  rudder  pedals,  flight  control  panel,  etc),  the  control  surface  and  speed  brake 
actuators,  and  the  leading-edge  flop  power  drive  unit.  The  AFTI/F-16  Digital  FCS  represents  a 
major  technological  advance  over  the  current  analog  FBW  FCS  used  in  the  operational  F-16's.  A 
DFCS  permits  the  pilot  to  choose  from  a  “menu''  of  multiple,  selectable  tasks/functions  in  order  to 
optimize  the  flight  control  task  as  a  function  of  flight  condition,  aircraft  configuration,  and  mission 
segment.  This  fact  is  illustrated  in  the  block  diagram  of  Figure  24. 

Basically  the  AFTI/F-16  DFCS  is  configured  as  a  triplex-redundant  system  with  three  independent 
electronic  branches.  The  prime  electronic  assemblies  are  the  three  identical  digital  Flight  Control 
Computers  (FCC's)  which  perform  the  functions  listed  in  the  schematic  of  Figure  25.  The  triplex 
aircraft  motion  sensors  (rate  gyros  and  accelerometers)  provide  feedback  stabilization  and  aircraft 
state  information  to  the  FCC's.  Quadruplex  redundant  pilot  sidestick  and  rudder  pedal  force  sensors 
accept  pilot  command  inputs  and  transmit  them  in  the  form  of  analog  voltage  signals  to  the  triplex 
FCC  complex  for  processing.  The  reason  for  using  quad-redundant  force  sensors  will  be  explained 
later. 

The  DFCS  is  protected  through  automatic  failure  detection  via  voting,  in-line  monitoring,  and 
analytical  redundancy  techniques,  failure  isolation,  and  subsequent  system  reconfiguration.  The 
triplex  DFCS  is  able  to  provide  two  fail-operational  performance  (within  a  95%  probability)  follow¬ 
ing  two  FCC  failures. 

Figure  25  illustrates  schematically  the  various  inputs  to  the  triplex  DFCS  complex,  the  values  of 
which  are  used  by  the  stored  control  laws  to  compute  control  surface  deflection  commands  which 
are  transmitted  to  the  seven  Integrated  Servoactuators  (ISA)  via  triplex  electrical  signal  paths. 

The  AFTI/F-16  aircraft  is  a  highly  modified  version  of  an  F-16A  from  which  the  analog  FBW  type 
FCS  has  been  removed  and  replaced  with  a  triplex  DFCS.  In  the  design  of  the  F-16  series  aircraft 
advanced  flight  control  technologies  were  allowed  to  impact  the  design  process  at  the  beginning. 

One  advanced  flight  control  concept,  in  particular,  that  of  Reload  Static  Stability  (RSS)  had  a  very 
large  impact  on  the  F-16  design  in  regard  to  its  resultant  aerodynamic  configuration,  size,  weight, 
range,  performance,  and  thrust  to  weight  ratio.  It  was  the  use  of  RSS  that  resulted  in  the  selection 
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of  an  analog  type  FBW  FCS.  Incorporation  of  the  RSS  concept  has  been  justified  by  its  contribu¬ 
tion  to  the  performance,  maneuverability,  and  range  of  the  F-16.  In  subsonic  flight  the  horizontal 
tail  (H.T.)  is  lifting  and  in  supersonic  flight  the  H.T.  experiences  a  down  load.  RSS  permits  this 
down  load  to  be  reduced.  Reduced  H.T.  trailing  edge  up  deflection  provides  the  following  benefits: 

•  Increased  aerodynamic  lift 

•  Reduced  trim  drcr 

These  benefits  in  turn  result  in: 

•  Reduced  wing  area  requirement  which  in  turn  allows  a  reduction  in  structural  weight  and 
skin  friction  drag. 

•  Reduced  fuel  requirements  for  a  given  range,  or  increased  range  for  a  given  amount  of  fuel. 

Three  basic  systems  comprise  the  FBW  type  FCC's  of  the  F-16  series  aircraft  and  are  listed  as 
follows: 

1.  Primary  Flight  Control  System  (PFCS) 

Provides  three-axis  flight  path  control  through  the  deflection  of  the  primary  control 
surfaces. 

2.  Secondary  Flight  Control  System  (SFCS) 

Provides  high  lift,  aerodynamic  braking,  and  improved  maneuvering  performance  through 
the  deflection  of  lift  and  drag  modulation  devices. 

3.  Air  Data  System  (ADS) 

Provides  aerodynamic  intelligence  for  the  FCS  and  other  using  systems.  Sensed  aero¬ 
dynamic  parameters  are  inserted  in  the  flight  control  law  equations  for  computation  by 
the  FCC's. 

The  optimal  integration  of  these  three  systems  results  in  FCS's  that  possess  a  variety  of  advanced 
capabilities  and  unique  features.  Those  common  to  both  the  analog  and  digital  FCS's  will  be  listed 
initially  in  Table  3.  The  additional  capabilities  and  unique  features  of  the  AFTI/F-16  DFCS  will 
be  listed  subsequently  in  Table  4. 

The  basic  FCS  functional  characteristics  of  the  operational  F-16's  with  analog  FBW  systems  are 
presented  in  Table  5  (obtained  from  Reference  9)  and  are  catagorized  into  the  following  areas: 

•  Primary  Control  Surfaces 

•  Secondary  Control  Surfaces 

•  Trim 

•  Pilot's  Primary  Controls. 

The  data  in  Table  5  is  also  applicable  to  the  AFTI/F-16  DFCS  and  provides  insight  as  to  the  pilot 
controller  inputs  used  to  command  the  required  combinations  of  control  surface  deflections  to 
create  pitch,  roll,  and  yaw  moments  and  to  trim  the  aircraft.  However,  some  of  the  quantitiative 
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TABLE  3.  CAPABILITIES  AND  FEATURES  COMMON  TO  BOTH  THE 
CURRENT  F16  AND  THE  AFTI/F-16 


•  Full  FBW  FCS  provides  maximum  flexibility  for  optimizing  flying  qualities  and  the 
flight  control  task  over  the  entire  flight  envelop. 

•  Use  of  the  RSS  concept  with  its  many  benefits. 

•  Three-axis  Command  Augmentation  System  (CAS)  and  Stability  Augmentation 
System  (SAS)  provides  precise  control  and  excellent  handling  qualities. 

•  Automatic  angle-of-attack  (AOA)  and  i  irmal  load  factor  limiting  allow  the  pilot 
to  use  maximum  capability  of  the  airplane  without  inadvertent  loss  of  control. 

•  Aileron-rudder  interconnect  provides  improved  high  AOA  handling  qualities. 

•  Combined  programming  of  the  leading  and  trailing  edge  flaps  provides  optimized  air¬ 
foil  camber  for  high  L./D  during  cruise  and  maneuvering  flight. 

•  Effective  leading  edge  and  trailing  edge  flaps  provide  good  take-off  and  landing 
performance. 

•  Effective  speed  brake  provides  good  speed  control  in  maneuvering  flight. 

•  Redundancy  of  components  and  signal  paths  contributes  to  high  probability  of 
mission  completion  and  increased  flight  safety. 

•  Pilot's  side-stick  controller  enhances  precise  control  at  high  load  factors. 

•  Built-in  test  capability  ensures  FCS  flight  readiness  with  minimal  downtime  for 
maintenance  actions. 


TABLE  4.  CAPABILITIES  AND  FEATURES  UNIQUE  TO 
THE  AFTI/F-16 

•  Six  independent  degrees  of  freedom  flight  control  capability  over  the  entire  flight 
envelop. 

•  The  following  advanced  longitudinal  control  modes: 

—  Direct  lift  (direct  control  of  An) 

—  Fuselage  pointing  {a-\  mode) 

—  Vertical  translation  (02  mode) 

•  The  following  advanced  directional  control  modes: 

—  Direct  sideforce  (direct  control  of  Ay) 

-  Fuselage  pointing  (/3 1  mode) 

—  Lateral  Translation  (^  2  mode) 
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TABLE  4.  CAPABILITIES  AND  FEATURES  UNIQUE  TO 

THE  AFTI/F-16  -Continued 

■ 

• 

Maneuver  enhancement/gust  alleviation  to  provide  the  following  benefits: 

—  Automatic  direct  lift  through  force  stick  error  signal 

—  Quickened  pitch  response 

—  More  precise  target  tracking 

—  Reduced  aircraft  response  to  random  turbulence  and  gusts 

—  Elimination  of  "g"  lag 

I 

r.  -• 

• 

Digital  type  FCC's  permit  optimal  integration  of  flight,  fire,  and  propulsion  control 
technology  advancements. 

■/. 

• 

Use  of  in-flight  integrity  management  to  improve  flight  safety. 

• 

Automatic  weapon  line  pointing. 

1 

• 

Reduced  redundancy  levels  to  reduce  costs,  spares,  weight,  space,  and  power  require¬ 
ments  and  retain  typical  FCS  high  reliabilities. 

• 

Integrated  flight  controls  and  Flight  Management  Display  System  (FMDS)  to  reduce 
pilot  workload  and  simplify  cockpit  layout. 

i 

values  in  Table  5  will  not  be  exactly  the  same  as  for  the  AFTI/F-16.  The  table  provides  no  data  on 
the  canards  of  the  AFTI/F-16.  The  use  of  the  canards  to  enhance  multi-mode  capabilities  will  be 
discussed  later. 

1.  Primary  Flight  Control  System  (PFCS) 

■ 

*w  / 

The  PFSC  interfaces  directly  with  the  Secondary  Flight  Control  System  (SFCS)  and  the  Air  Data 

System  (ADS).  The  interface  with  the  ADS  is  shown  in  Figure  26. 

S*V 

*• 

Longitudinal  or  pitch  control  is  achieved  through  fore-and-aft  forces  applied  to  the  Side  Stick 

Controller  (SSC)  in  addition  to  the  SSC  pitch  commands  the  following  signals  also  influence  pitch 
control: 

• 

Angle-of- attach  (a) 

• 

Dynamic  pressure 

< 

• 

• 

Ratio  of  dynamic  pressure  to  static  pressure  (qc/Ps) 

Pitch  rate 

v  ’ 

• 

Differential  commands  to  the  horizontal  tails  for  augmenting  roll  control 

• 

Pitch  trim 

# 

• 

Normal  acceleration 

• 

Autopilot  inputs 

• 
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TABLE  5.  F -16  FLIGHT  CONTROL  SYSTEM  FUNCTIONAL  CHARACTERISTICS 

PRIMARY  CONTROL  SURFACES 


AXIS 


Type  of  Surface 


Deflection  (Max) 
(1  to  Hinge  Line) 


Stall  Hinge  Moment 
(Both  Hyd  Systems) 


Stall  Hinge  Moment 
(One  Hyd  System) 


LONGITUDINAL 

LATERAL 

Horizontal  Tail 

Flaperon 

Asymmetrical 
Horiz  Tail 

±25  Deg 

+20  to  -23  Deg 

±5  Deg  (Min.) 
±10  Deg  (Max.) 

60  Qeg/Sec 

52  Deg/Sec 

±60  Deg/Sec 

14,400  Ft- Lb  @0  Deg 

15,850  Ft- Lb 
@  20  Deg 

14,400  Ft  Lb 
@  0  Deg 

7,200  Ft- Lb 

7,925  Ft-Lb 

7,200  Ft-Lb 

@  0  Deg 

@  20  Deg 

@  0  Deg 

DIRECTIONAL 


Rudder 


±30  Deg 


120  Deg/Sec  @  0  H  M 


4.700  Ft-Lb  @  12  Deg 


2,360  Ft-Lb  @  12  Deg 


SECONDARY  CONTROL  SURFACES 


TYPE  OF 
SURFACE 

LEADING  EDGE 

FLAP 

FLAPERON 

SPEED  BRAKE 

Deflection  (Max) 
(Stream  wise) 

-2  to  +25  Deg 

+20  to  -23  Deg 
(T.E.  Flap) 

mam 

Surface  Rate  Limit 
(Max,  No  Load) 

30  Deg/Sec  @  0  H.M. 

5  Deg/Sec  (flap  fund, on) 

1 

Stall  Hinge  Moment 
(Both  Hyd  Systems) 

175,000  In-Lb  @  0  Oeg 

15,850  Ft-Lb  @20  Deg 

Single  System  Only 

Stall  Hinge  Moment 
(One  Hyd  System) 

87,500  In- Lb  @  0  Deg 

7,925  Ft  Lb  @20  Deg 

6,065  Ft  Lb/Surface 

Command  Servo 

Oual  Position  8i  Rate 
Electrical  Feedback 

None 

None 

AXIS 

LONGITUDINAL 

Type  of  Surface 

Horizontal  Tail 

Authority 

±2.4  G's  (Surface  Deflection 
a  Function  of  Variable  Gam) 

Trim  Rate 

+.90  G's/Sec  from 

Pilot's  Controller 

AXIS 

LONGITUDINAL 

Type 

Pilot  s  Sidestick  Controller 

Displacement 

Minimum 

Breakout 

±1.75  Lb 

Maximum  Force 

Max  Command 
(+10.86  G's  at  40.0  Lb  Aft) 

(-4  G's  at  18.44  Lb  Fwd) 

LATERAL 


Flaperon  and  Horiz 
Tail  Variable  Ratio 


±66.7  Deg/Sec 


±4.5  Deg/Sec/Sec  from 
Pilot's  Controller 


PILOT’S  PRIMARY  CONTROLS 


LATERAL 


Pilot's  Sidestick  Controller 


Minimum 


±1.0  Lb 


Max  Roll  Command 
(308  Deg/Sec  at  17.0  Lb) 


0 IRECTIONAL 


Rudder 


Set  by  Rate  Pilot 
Turns  Knob  on  Panel 


DIRECTIONAL 


Rudder  Pedals 


±0.5  In. 


±15.0  Lb 


Max  Surface  at  1 1 0  Lb 


i 


le  of- Attack 


Figure  26.  Air  Data  System  Interface  with  the  DFCS 
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The  pilot  applies  pitch  trim  by  displacing  the  four-way  trim  button  on  the  grip  of  the  side  stick. 

Fore  and  aft  displacements  of  the  trim  button  drive  an  electrical  gear-head  motor  that  is  located 
in  the  manual  trim  panel  and  connected  to  a  stack  of  three  potentiometers  and  a  thumb-operated 
pitch  trim  wheel.  Triplex  trim  signals  are  generated,  summed  with  other  pitch  command  signals, 
gain-adjusted,  and  sent  to  both  the  left  and  right  horizontal  tail  integrated  servoactuators  (ISA). 

Lateral  or  roll  control  is  achieved  through  lateral  forces  applied  to  the  SSC.  The  roll  axis  employs 
both  CAS  and  SAS  as  an  aid  to  achieving  precise  flight  path  control.  Roll  CAS  is  a  roll-rate-referenced 
command  system  capable  of  minimizing  the  roll  response  per  unit  of  lateral  side  stick  force.  Roll 
command  at  any  instant  is  a  function  of  the  following: 

•  Lateral  side-stick  force 

•  Roll  rate 

•  Roll  trim 

•  Autopilot  commands 

Both  flaperon  and  differential  horizontal  tail  deflections  are  used  for  roll  control  to  assure  that 
adequate  roll  control  power  is  available  throughout  the  flight  envelope. 

Roll  trim  is  achieved  in  a  manner  similar  to  pitch  trim.  Roll  trim  is  accomplished  by  lateral  dis¬ 
placement  of  the  four-way  trim  button  on  the  grip  of  the  side  stick  controller.  These  lateral  trim 
commands  drive  an  electric  gear-head  motor  in  the  manual  trim  panel.  Triplex  trim  signals  are 
generated,  summed  with  other  signals  and  gain-adjusted  to  provide  a  variable  trim  distribution  to 
the  flaperons  and  the  horizontals  tails  in  accordance  with  the  horizontal  tail-flaperons  ratio 
schedule. 

Directional  or  yaw  control  is  achieved  by  the  use  of  the  rudder  pedals.  The  yaw  axis  employs 
basic  stability  augmentation  for  yaw  damping  and  automatic  turn  coordination  through  the  use 
of  lateral  acceleration  referenced  command  augmentation.  A  gain  adjusted  aileron-rudder  inter¬ 
connect  (ARI)  and  a  roll  rate-to-rudder  cross  feed  minimize  roll-yaw  coupling,  extend  the  AOA 
for  departure  boundary,  improve  tracking,  increase  spin  resistance,  and  provide  improved  turn 
coordination.  Rudder  commands  at  any  instant  are  a  function  of  the  following  parameters: 

•  Rudder  pedal  force 

•  Yaw  trim 

•  Yaw  rate 

•  Lateral  acceleration 

The  pilot  trims  the  aircraft  in  yaw  by  rotating  the  yaw  trim  knob,  on  the  manual  trim  panel,  which 
is  connected  to  a  stack  of  three  potentiometers  which  generate  triplex  yaw  trim  signals.  These 
signals  are  summed  with  other  signals  in  the  FCC's  and  sent  to  the  rudder  ISA. 

2.  The  Secondary  Flight  Control  System  (SFCS) 

The  Secondary  Flight.  Control  System  (SFCS)  consists  of  the  following  elements: 

•  Full-span  leading-edge  flap  (LEF). 

•  Flaperons  functioning  as  trailing  edge  flaps  (TEF). 
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•  Speed  brakes  located  on  each  side  of  the  aft  fuselage. 

•  Canards  functioning  as  speed  brakes  by  deflecting  the  leading  edges  of  each  inward  (toe-in). 

The  LEF  is  scheduled  as  a  function  of  Mach  number  and  AOA  with  the  scheduling  being  based  on 
performance  improvement  and  buffet  reduction  rather  than  on  stability  and  control  requirements. 
The  LEF  provides  the  following  benefits: 

•  Increased  lift  for  take  off  and  landing . 

•  Automatic  and  near  optimal  wing  camber  as  a  function  of  flight  condition  thereby  providing 
improved  turning  capability  and  increased  effectiveness  of  the  vertical  fin  at  high  AOA. 

TEF  flap  and  roll  commands  are  summed  in  the  FCC's  to  produce  a  desired  flaperon  deflection. 

In  the  F-16  FBW  systems  no  additional  components  are  required  to  accomplish  the  TEF  function 
except  for  the  electronic  components  required  to  accept  the  flap  command  in  the  FCC's.  The 
absence  of  a  flap  command  to  the  FCC's  results  in  a  zero  flap  command  to  the  flaperons. 

The  speed  brake  consists  of  two  pairs  of  clamshell  surfaces  located  adjacent  to  the  engine  nozzle 
and  inboard  of  the  horizontal  tail  surfaces  in  the  trailing  edge  of  the  left-  and  right-hand  horizontal 
tail  shelf  structure.  See  Figure  27  obtained  from  Reference  9.  Each  speed  brake  consists  of  the 
following: 

•  A  double  acting  hydraulic  actuator. 

•  An  upper  door  with  linkage. 

•  A  lower  door  with  linkage. 

•  Three  hinged  seals  that  are  activated  by  the  motion  of  the  speed  brake. 

Figure  27  shows  in  detail  the  mechanization  of  the  speed  brakes,  location,  and  maximum  available 
deflection. 


AFTI/F-16  AIR  DATA  SYSTEM  (ADS) 

The  configuration  of  the  AFTI/F-16  Air  Data  System  is  shown  in  Figure  26.  This  configuration 
is  basically  the  same  as  that  of  the  F-16  with  the  exception  of  the  addition  of  two  sideslip  probes, 
which  are  identical  to  the  AOA  probes,  and  repositioning  of  the  right-side  air  data  probe  to  eli¬ 
minate  canard  interference.  The  Electronic  Component  Assembly  (ECA)  used  in  the  F-16  ADS 
is  not  required  in  the  AFTI/F-16  ADS  because  its  functions  can  be  performed  in  the  digital  FCC's. 

The  AFTI/F-16  ADS  is  comprised  of  the  following  units: 

•  Nose  mounted  air  data  probe. 

•  Fuselage  side-mounted  air  data  probe. 

•  Two  flush  fuselage-mounted  static  pressure  ports. 

•  Two  radome  mounted  AOA  transmitters. 

•  Nacelle  mounted  total  temperature  probe. 

•  Pneumatic  Sensor  Assembly  (PSA) 
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Figure  27.  Mechanization  of  the  Speedbrake 


•  Central  Air  Data  Computer  (CADC). 

•  Sideslip  differential  pressure  sensor. 

•  Two  Angle-of-Sideslip  (AOS)  transmitters. 

Three  independent  sources  of  total  pressure  (Py),  static  pressure  (Pg),  AOA,  and  AOS  are  sensed 
and  converted  to  electrical  signals.  Middle-value  selection  of  the  air  data  parameters  are  employed 
to  provide  triplex  identical  signals  to  be  inputted  to  the  FCC's  for  control  law  computation,  gain 
scheduling,  and  LEF  computation. 

1.  Air  Data  Probes  - 

The  nose  mounted  in  data  probe  provides  dual  sources  of  static  ' Ps i  and  PS2  and  total 
Pj}  and  PT2)  pressures.  Aerodynamic  compensation  is  provided  to  minimize  the  static 
pressure  source  position  error.  The  multi  purpose  fuselage  air  data  probe  (also  referred 
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to  as  the  side-mounted  probe)  provides  a  single  source  of  static  and  total  pressure  and 
AOA.  Aerodynamic  compensation  is  provided  to  minimize  the  static  pressure  source 
position  error.  This  multi-purpose  probe  provides  five  pneumatic  outputs  (PT3,  PS3- 
PaV  Pa2-  anc*  P/3)  as  inputs  to  the  Pneumatic  Sensor  Assembly  (PSA)  where  pressure 
transducers  convert  pneumatic  signals  to  electrical  analog  signals.  The  method  of  sensing 
AOA  is  the  same  as  that  described  for  the  multipurpose  probe  shown  in  Figure  3.  The 
AOS  ports  are  pneumatically  connected  together  to  provide  a  pseudo-static  pressure 
(Pj3  )  reference. 

A  nacelle  mounted  total  temperature  probe  provides  the  Central  Air  Data  Computer 
(CADC)  with  a  total  temperature  (Ty)  signal  (analog).  This  signal  is  required  by  the  CADC 
for  true  airspeed  and  air  density  ratio  computations.  The  probe  is  installed  on  the  left 
side  of  the  engine  nacelle  so  that  the  intake  of  the  total  temperature  probe  is  located 
outside  of  any  boundary  layer  and  not  in  the  wake  of  any  upstream  portion  of  the  aircraft. 

2.  Static  Pressure  Ports 

Two  flush-mounted  static  pressure  ports  provide  inputs  to  a  Sideslip  Differential  Pressure 
Sensor  for  AOS  measurement.  This  measurement  is  used  to  compensate  the  third  AOA 
source  (Side-Mounted  Air  Data  Probe)  error.  The  flush  ports  are  located  diametrically 
opposite  to  each  other  and  forward  of  the  cockpit. 

3.  Sideslip  Differential  Pressure  Sensor 

This  sensor  is  installed  remotely  to  the  PSA  to  provide  an  AOS  function  to  the  digital 
Flight  Control  Computers  (FCC).  The  sensor  output  is  a  function  of  AOS  and  dynamic 
pressure. 

4.  Angle-of-Attack  (AOA)  Transmitters 

Two  conical  air-flow-detector  type  AOA  transmitters  are  mounted  diametrically  opposite 
on  each  side  of  the  radome.  Each  transmitter  contains  three  identical  rotary  voltage 
differential  transformer  (RVDT)  outputs,  one  output  to  each  of  the  FCC's  (see  Figure  26). 
These  transmitters  convert  conical  probe  rota  ion  (a  function  of  airflow  striking  probe 
slots)  to  electrical  analog  signals. 

5.  Angle-of-Sideslip  (AOS)  Transmitters 

These  units  are  AOA  transmitters  mounted  on  the  underside  of  the  fuselage  in  a  manner 
to  sense  AOS.  Their  triplex  outputs  are  sent  to  the  FCC's  (see  Figure  26). 

6.  Pneumatic  Sensor  Assembly  (PSA) 


The  PSA  contains  eight  pressure  sensors  that  convert  pneumatic  inputs  from  the  nose 
and  fuselage  mounted  air  data  probes  into  electrical  signals.  The  differential  pressure 
type  AOA  signal  is  normalized  to  dynamic  pressure  at  the  hemispherical  head  of  the 
side  mounted  air  data  probe.  This  dynamic  pressure  is  provided  by  subtracting  the 
average  AOS  pressures  (psuedo-static  pressure)  from  the  total  pressure  at  the  hemispherical 
head.  Normalization  (division)  is  achieved  by  use  of  a  multiplier  as  a  feedback  element 
in  an  operational  amplifier  circuit.  The  PSA  supplies  triplex  static  and  dynamic  pressure 
signals  to  the  FCC's. 
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7.  Central  Air  Data  Computer  (CADC) 

The  CADC  is  a  digital  computer  which  accepts  inputs  from  the  nose-mounted  air  data 
probe,  total  temperature  probe,  and  the  two  AOA  transmitters.  The  CADC  consists 
of  the  following  six  basic  functional  sections: 

1.  Power  Supply 

2.  Pressure  Sensors  (2) 

3.  Input  Data  Converter  (I DC) 

4.  Digital  Processor  (DP) 

5.  Output  Data  Converter  (ODC) 

6.  Chassis  Assembly 

The  values  of  Pfi  and  Ps-|  are  inputted  into  the  Input  Data  Converter  (I  DC)  via  two 
pressure  sensors  and  the  barometric,  AOA  and  total  temperature  signals  are  inputted 
directly  to  the  multiplexer  and  A/D  converter  section  of  the  I  DC.  The  I  DC  converts 
the  data  from  these  inputs  to  digital  form  and  transmits  them  to  the  digital  processor 
(DP)  section  for  processing.  The  input  data  is  corrected  for  source  errors  in  the  com¬ 
puter.  The  required  CADC  outputs  are  calculated,  formatted,  and  transferred  to  the 
output  data  converter  (ODC)  section.  The  ODC  converts  the  data  to  the  appropriate 
signal  form  (digital,  analog,  synchro,  discrete)  and  distributes  the  following  air  data 
parameters  to  the  using  systems: 

•  Pressure  altitude  (Hp)  (referenced  to  29.92  in  Hg) 

•  Pressure  altitude  (HpgQ)  (referenced  to  altimeter  barometric  setting) 

•  Pressure  altitude  rate  (Hp) 

•  Pressure  ratio  (Pg/PsiJ 

•  True  temperature  (Tp^y) 

•  Calibrated  airspeed  (Vq) 

•  True  airspeed  (Vy) 

•  True  angle-of-attack  (a) 

•  Air  density  ratio  ( a ) 

8.  Air  Data  System  Redundancy  Management 


All  air  data  parameters  essential  for  flight  control  law  computation  are  inputted  to  the 
FCC's  to  a  triplex  level  of  redundancy.  Redundancy  management  (failure  detection, 
isolation,  and  reconfiguration)  of  these  inputs  are  performed  by  the  FCC's.  Initial 
failures  are  detected  by  middle  value  voting  techniques  and  the  failed  input  is  isolated 
thereby  permitting  single-failure  operational  capability.  After  the  occurrence  of  a 
second  like  failure  it  is  not  possible  to  isolate  the  failed  input  by  using  voting  techniques 
and  the  data  from  two  sensors  is  ignored.  The  FCC's  will  then  employ  a  backup  set  of 
flight  control  laws  that  provide  alternative  control  laws  that  provide  at  least  Level  2 
flying  qualities  with  a  goal  of  level  1. 
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After  the  failure  of  a  second  AOA  sensor  the  AOA  feedback  will  be  removed  and  not  used 
as  an  aid  in  the  computation  of  control  laws.  In  the  cases  of  dual  failures  of  the  other  air 
data  sensors  fixed  gains  will  be  used  in  control  law  computation. 


FLIGHT  CONTROL  COCKPIT  CONTROLS 

The  AFTI/F-16  flight  control  cockpit  controllers  consist  of  a  right  side  mounted  Side-Stick  Con¬ 
troller  (SSC)  Assembly,  a  Rudder  Pedal  Assembly,  an  FCS  Control  Panel,  and  a  Rotatable  Throttle 
Controller  Grip  for  pitch  pointing  control. 

1.  Side-Stick  Controller  (SSC)  Assembly 


The  SSC  is  equipped  with  physically  and  electrically  isolated  transducers  so  that  applied 
forces  (resulting  in  only  small  total  displacements)  to  the  stick  grip  will  generate  quadrex 
electrical  command  signals.  These  signals  are  summed  with  other  signals,  gain-adjusted  in 
the  FCC's,  and  transmitted  to  the  primary  control  surface  integrated  servo-actuators. 
Linear  variable  differential  transformer  (LVDT)  type  transducers  are  used  in  these  appli¬ 
cations. 

The  pilot  achieves  longitudinal  pitch  control  through  fore-and-aft  forces  applied  to  the 
minimum-deflection  type  force-sensing  controller.  In  a  similar  manner,  the  pilot  achieves 
lateral  or  roll  control  through  lateral  forces  applied  to  the  SSC.  Figure  28  shows  the 
installation  and  assembly  of  the  SSC  for  the  F-16  and  was  obtained  from  Reference  9. 


TOP 

VIEW 


I  GUN/CAMERA  Trigger  {2  position) 

2.  NWS/A/R  DISC/MSI  STEP  Button 
3  OESIG/RET  SRCH  Switch  (2  «oy,  Momentary) 

4.  TRIM  Button  (4  way,  Momentary) 

5.  WPN  REl  Button 

6.  Side  Slick  Grip 

7.  Paddle  Switch 


Figure  28.  Installation  and  Assembly  of  the  Side-Stick  Controller  (SSC)  for  the  F-16 
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The  AFTI/F-16  SSC  grip  is  the  same  as  the  F-16  grip  except  that  two  switch  housings  have 
been  added,  one  4-way  slide  switch  is  located  where  the  F-16  grip  has  a  2-way  slide  switch, 
and  since  the  autopilot  disconnect  is  not  required,  the  space  is  used  for  the  Integrated 
Flight  and  Fire  Control  (IFFC)  switch. 

The  switch  housings  were  added  to  provide  room  for  three  new  redundant  switches.  The 
Independent  Backup  Unit  (IBU)  and  Control  Configured  Vehicle  (CCV)  switches  are 
located  in  the  top  housing.  A  flip-over  paddle  was  added  to  the  top  housing  to  provide 
switch  actuation  for  the  CCV  switch.  The  IFFC  switch  is  located  in  the  lower  housing 
on  the  aft  side  of  the  stick  and  is  operated  through  the  paddle  located  at  the  lower  forward 
side  of  the  stick. 

The  new  4-way  slide  switch  was  added  to  provide  the  Helmet  Mounted  Sight  (HMS)  switch¬ 
ing  feature.  The  switch  is  located  in  the  same  position  as  the  2-way  DESIG-RET  SRCH  is 
located  on  the  F-16  grip.  The  HMS  position  is  on  the  inboard  side.  A  space  position  is 
on  the  outboard  side. 

The  trigger  switch  is  the  same  as  for  the  F-16  grip  except  the  name  has  been  changed  from 
CAMERA/GUN  to  RCD-LASER/GUN.  The  descriptions  of  the  AFTI/F-16  grip  was  obtained 
from  reference  10.  Figure  29  shows  the  AFTI/F-16  Side-Stick  Controller  (SSC). 

The  AFTI/F-16  SSC  will  be  essentially  two-fail  operative.  Quadrex  force  transducers  in 
both  the  pitch  and  roll  axes  are  used  as  an  aid  in  detecting  and  isolating  single  and  dual 
failed  force  transducers.  Figure  30  is  a  cross  sectional  view  of  the  transducer  portion  of 
the  SSC  showing  the  locations  of  the  pitch  and  roll  LVDT's,  four  per  control  axis. 


Figure  29.  AFTI/F-16  Side  Stick  Controller  (SSC) 
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;■  Figure  30.  Cross-Sectional  View  of  Transducer  Portion  of  the  Side-Stick  Controller 
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2.  Rudder  Pedal  Assembly 

The  rudder  pedal  assembly  for  the  AFTI/F-16  is  the  same  as  for  the  F-16.  This  assembly 
consists  of  a  minimum-deflection  force-sensing  pair  of  conventional  rudder  pedals.  The 
pilot  achieves  directional  control  through  translation  of  either  pedal  (approximately 
±0.5  inch)  to  generate  quadrex  electrical  signals  using  an  LVDT  type  transducer.  These 
signals  are  summed  with  other  gain-adjusted  signals  in  the  FCC's  and  transmitted  to  the 
rudder  ISA.  Rotation  of  either  pedal  generates  dual  electrical  brake  command  signals 
from  two  LVDT  type  transducers.  The  rudder  pedal  assembly  is  also  used  for  nose  wheel 
steering. 

The  rudder  pedals  are  used  for  yaw  pointing  of  the  aircraft  when  the  FCS  is  configured 
to  operate  in  one  of  the  pilot  selected  advanced  control  modes.  Figure  31  illustrates  the 
configuration  of  the  rudder  pedal  assembly. 

The  AFTI/F-16  Rudder  Pedal  Assembly  is  also  two-fail  operative.  Quadrex  force  sensors 
are  used  as  an  aid  in  isolating  single  and  dual  failed  force  transducers. 

3.  Flight  Control  Panel 


The  Flight  Control  Panel  Assembly  is  located  on  the  pilot’s  left  hand  side  as  shown  in 
Figure  32.  It  provides  a  redundant  or  backup  set  of  trim  and  reset  switches.  The 
components  on  the  panel  are: 


Figure  31.  Rudder  Pedal  Assembly 


53 


54 


NADC-82240-60 


•  Redundant  Trim  Switches  (3  position  toggle) 

1.  LYAW 
R  YAW 

2.  L  WING  DN 
R  WING  DN 

3.  NOSE  UP 
NOSE  DN 

•  Fault  Reset  Switches  (pushbutton) 

1.  Electronic 

2.  Servo 

•  Redundant  Stick  Trim  Switch 
(2  position  toggle:  OFF-ON) 

When  the  Stick  Trim  Switch  is  positioned  to  "ON",  trim  functions  can  be  controlled  from 
the  stick  trim  button  on  the  6SC  or  from  the  Flight  Control  Panel.  The  "OFF"  position 
of  the  Stick  Trim  Switch  deactivates  the  SSC  trim  button  so  that  trim  can  only  be  con¬ 
trolled  through  the  Flight  Control  Panel  trim  switches.  The  backup  trims  are  required 
because  the  SSC  trims  are  nonredundant.  The  panel  trim  funct'ons  are  implemented  as 
triply  redundant  discrete  inputs  to  the  FCC's  where  the  trim  integration  function  resides 
in  software.  The  reset  buttons  are  included  on  the  panel  to  permit  "blind"  failure  resets 
for  those  rare  instances  when  both  Multi-Purpose  Displays  (MPD)  are  not  operational. 

The  panel  resets  operate  essentially  the  same  as  the  MPD  resets  in  the  way  they  reset  a 
first  or  second  like  failure. 

The  term  second  like  failure  refers  to  two  independent  failures  which  have  been  detected 
by  the  same  monitor  and  does  not  necessarily  imply  that  the  two  failures  were  physically 
identical.  For  example,  given  that  the  first  failure  was  branch  A  pitch  rate  gyro,  then  a 
second  like  failure  would  include  a  pitch  rate  input  demodulator  in  branch  B  or  C,  an 
A/D  converter  failure  in  B  or  C,  an  800  Hz  power  supply  in  B  or  C  as  well  as  an  identical 
pitch  rate  gyro  failure  in  branches  B  or  C. 

There  are  no  limitations  as  to  which  failures  may  be  reset  or  the  number  of  times  a  reset 
request  may  be  repeated.  The  FCS  Operational  Flight  Plan  (OFP)  presents  a  second 
failure  from  being  reset  back  to  the  no  failed  state  and  creating  the  chance  for  an  apparent 
simultaneous  dual  like  failure  situation  with  potential  loss  of  control.  The  price  paid  for 
this  added  protection  is  that  the  first  failure  must  be  latched  in  permanently  whenever  a 
second  like  failure  occurs. 

4.  Rotatable  Throttle  Controller  Grip 

Rotation  of  the  Rotatable  Throttle  Controller  Grip  provides  the  controlling  inputs  of  the 
following  CCV  modes  upon  pilot  selection: 

•  Pitch  Pointing 

•  Vertical  Translation 

•  Direct  Lift 
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The  entire  Throttle  Assembly  as  shown  in  Figure  33,  is  located  in  the  cockpit  above  the  left  console 
and  is  operated  by  conventional  fore  and  aft  motion.  The  throttle  grip  rides  on  a  spline  shaft  on 
recirculating  ball  bearing  with  a  total  travel  of  8.12  inches.  Each  end  of  the  spline  shaft  is  mounted 
to  aircraft  structure  with  small  brackets.  The  output  of  the  throttle  linkage  is  connected  to  an  en¬ 
closed  push-pull  control  to  transmit  motion  to  the  engine  mounted  fuel  control. 

5.  Interface  With  the  Flight  Control  Computers  (FCC) 


The  redundant  analog  and  discrete  inputs  from  the  cockpit  controllers  are  supplied  to  each 
FCC  with  the  required  cross-strap  for  redundant  data  selection  implemented  by  a  serial 
digital  data  exchange  between  the  FCC's.  Analog/Digital  (A/D)  conversion  of  the  inputted 
cockpit  controller  signals  takes  place  within  the  FCC's. 
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FLIGHT  CONTROL  INERTIAL  SENSORS 

The  AFTI/F-16  Primary  FCS  inertial  sensors  are  contained  in  s  Rate  Gyro  Assembly  and  an  Acceler¬ 
ometer  Assembly  which  are  identical  to  those  used  in  the  production  versions  of  the  F-16.  These  are 
quadrex  units  designed  for  use  in  the  quadrex  analog  type  FBVV  system  for  the  F-16.  For  use  in  the 
AFTI/F-16  only  3  of  each  of  the  4  like  sensors  will  be  interfaced  with  the  triplex  DFCS. 

Dual  like  inertial  sensor  failures  will  not  produce  a  loss-of-control  condition.  The  second  like  failure 
will  be  detected  by  cross  channel  monitoring,  and  a  "control  law  reconfiguration"  scheme  will  be 
used  to  maintain  safe  flight. 

1.  Rate  Gyro  Assemblies 

Three  Rate  Gyro  Assemblies  (one  each  for  pitch,  roil,  and  yaw)  consist  of  four  rate  gyros 
each  to  provide  redundant  signals  as  a  function  of  body  rates  about  their  respective  axes. 
For  the  AFTI/F-16  one  rate  gyro  in  each  assembly  will  not  be  interfaced  with  the  triplex 
DFCS.  Figure  34  shows  the  installation  of  the  Rate  Gyro  Assemblies.  The  Rate  Gyro 
Assemblies  are  identical  for  each  of  the  three  locations  and  do  not  require  separate  stock¬ 
ing  for  three  different  applications.  Spring-balanced,  floated  rate  gyros  are  used;  each  rate 
gyro  contains  a  permanent  magnet  torquer  for  self  testing  and  a  monitor  of  spin-motor 
lead-phase  voltage  characteristics.  Each  rate  gyro  subassembly  contains  a  phase-splitting 
capacitor  potted  in  the  head  pin  end),  a  cable,  and  external  connector. 


Figure  34.  Installation  o>  the  Rate  Gyro  Assemblies 
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2.  Accelerometer  Assembly 


The  Accelerometer  Assembly  consists  of  eight  identical  torque-balanced  accelerometers 
fastened  to  a  common  mounting  base  and  enclosed  with  an  aluminum  dust  cover.  Each 
accelerometer  is  entirely  self-contained,  analog  closed-loop,  sensing  transducer  having 
all  solid-state  silicon  electronics.  Four  of  the  accelerometers  are  aligned  within  the 
assembly  to  sense  acceleration  along  the  normal  axis  and  four  for  sensing  lateral  accel¬ 
eration.  For  application  to  the  AFTI/F-16  one  of  the  lateral  and  of  the  normal  accel¬ 
erometers  will  not  be  interfaced  with  the  triplex  DFCS.  The  installation  of  the 
Accelerometer  assembly  in  the  aircraft  is  shown  in  Figure  35.  The  location  of  the 
installation  is  consistent  with  requirements  to  yield  minimum  body-bending  effects  and 
maximum  aerodynamic  stability.  The  physical  center  of  the  Accelerometer  Assembly 
is  located  forward  of  the  aircraft  C.G.  as  near  as  practicable  to  the  center  of 
percussion. 


For  self-test  purposes,  an  external  electrical  command  is  summed  linearly  in  the  torquing 
coil  of  the  accelerometer.  The  accelerometer  mounting  flange,  located  near  the  C.G. 
of  the  assembly,  contains  four  threaded  mounting  holes.  Each  of  the  four  external 
connectors  is  equipped  with  two  split  cables  and  end  connectors.  One  split  cable  is 
connected  to  a  normal  accelerometer;  the  other,  to  a  lateral  accelerometer. 

3.  Interface  with  the  Flight  Control  Computers 


Figure  36  shows  the  method  of  interfacing  or  inputting  the  analog  outputs  of  the  flight 
control  inertial  sensors  into  the  triplex  FCC  complex.  The  output  of  each  sensor  is 
directly  inputted  into  one  of  the  FCC's.  This  input  is  transmitted  to  the  other  two 
FCC's  via  the  intercomputer  data  link.  All  FCC's  know  the  current  inputted  value 
from  each  sensor  and  each  FCC  is  capable  of  performing  the  failure  detection,  isolation, 
and  reconfiguration  task. 

4.  Redundancy  Management  and  Reconfiguration  Technique 


Failure  detection  and  isolation  of  the  inputted  inertial  sensor  data  is  performed  at  the 
Input  Voting/Monitoring  Plane  (see  Figure  36)  which  is  in  the  software  programmed 
into  the  triplex  FCC  complex.  Redundant  inertial  sensor  inputs  are  supplied  to  each 
FCC  with  the  redundant  data  selection  implemented  by  a  serial  digital  data  exchange 
between  the  FCC's.  First  and  second  like  sensor  failures  are  detected  by  cross-channel 
monitoring  techniques.  After  a  sensor  failure  the  average  values  of  the  remaining  two 
sensors  are  used  by  the  FCC's.  After  a  second  like  sensor  failure  no  effort  is  made  to 
determine  which  of  the  two  remaining  sensors  is  failed  and  the  remaining  inputs  of  the 
particular  inertial  quantity  being  sensed  is  ignored.  The  flight  control  laws  which 
normally  utilized  the  values  of  the  sensed  inertial  parameter  are  reconfigured. 

The  AFTI/F-16  is  statically  unstable  >  subsonic  flight  and  must  employ  artificial 
means  to  restore  pitch  static  stability.  Control  laws  employed  to  artificially  restore 
static  stability  require  aircraft  pitch  rate  as  an  input.  To  avoid  aircraft  pitch  divergence 
and  subsequent  loss  of  control  after  the  loss  of  two  pitch  rate  sensors  a  backup  technique 
of  estimating  pitch  rate  (q)  is  utilized.  These  estimated  values  are  inputted  into  a  set  of 
backup  control  laws.  Estimation  of  pitch  rate  is  based  on  AOA  and  horizontal  tail 
position. 
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Figure  35.  Installation  of  Accelerometer  Assembly 


In  case  of  dual  loss  of  like  inertial  sensors  that  are  only  used  to  enhance  performance  the 
reconfigured  control  law  is  the  non-reconfigured  control  law  with  the  affected  feedback 
removed.  The  intent  is  to  provide  alternative  control  laws  that  provide  at  least  Level  2 
flying  qualities  with  a  goal  of  Level  1.  Inertial  sensor  reconfiguration  strategy  is  summa¬ 
rized  below 
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SENSORS 


•  Pitch  Rate  Gyro  • 

•  Normal  Accelerometer  _  • 

•  Roll  Rate  Gyro  • 

•  Lateral  Accelerometer  • 

•  Yaw  Rate  Gyro  • 


RECONFIGURATION  STRATEGY 
AFTER  SECOND  FAIL  MISCOMPARE 

Estimation  of  q  is  based  on  AOA  and  hori¬ 
zontal  tail  position 

Reconfiguration  to  pitch  rate  command 
system 

Remove  feedback  and  adjust  SSC  gain 
Remove  feedback 

Remove  Ay  and  \p  feedbacks,  use  only 
the  product  of  pa  feedback  to  rudder 


DIGITAL  FLIGHT  CONTROL  COMPUTER  (FCC)  COMPLEX 

The  digital  FCC  Complex  consists  of  three  Flight  Control  Computers  (FCC),  an  Actuator  Inter¬ 
face  Unit  (A!U)  and  four  Inverter  Control  Assemblies  (ICAI  which  provide  AC  power  for  the 
sensors.  The  FCC's  and  AIU  were  designed  and  fabricated  by  the  Bendix  Corporation.  The  FCC 
Complex  provides  the  performance  capability  required  of  the  FCS  for  the  six  DOF  AFTI/F-16 
aircraft  during  both  ground  and  airborne  operations.  The  FCC's  are  advanced  third  generation 
Bendix  Model  BDX-930  processors  incorporating  innovative  redundancy  management  concepts. 
The  triplex  FCC  Complex  is  fully  operational  after  a  first  FCC  failure.  The  probability  of  main¬ 
taining  Operational  State  1  performance  after  a  second  FCC  failure  is  greater  than  95  percent. 
The  three  FCC's  are  physically  and  functionally  identical  and  contain  identical  software. 

The  FCC's  provide  the  computational  power  required  to  implement  the  AFTI/F-16  airframe 
performance  requirements.  Signals  from  airframe  sensors  and  indicators,  and  electrical  power 
are  supplied  to  the  FCC's  to  permit  the  required  Stability  Augmentation  System/Command 
Augmentation  System  (SAS/CAS)  computations.  Also  supplied  to  the  FCC's  are  inputs  from 
the  pilot's  controllers  and,  through  the  airplane  multiplex  bus,  interactive  mode  selection  and 
failure  annunciation  and  recovery.  The  AFTI/F-16  is  controlled  by  the  FCC's  and  the  AIU 
through  appropriate  commands  to  the  flight  control  surfaces. 

1 .  Interface  Between  FCC  Complex  and  the  FCS 

The  salient  interface  signals  between  the  FCC  Complex  and  the  FCS  are  shown  in 
Figure  25,  most  of  which  being  of  the  analog  type.  Input  filtering  is  provided  on 
all  analog  inputs  for  high  frequency  noise  suppression,  and  the  I/O  is  protected 
from  EMI  and  lightning  induced  electrical  transients. 

The  FCC  Complex  supplies  certain  instrumentation  output  signals,  such  as  angle 
of  attack  and  sideslip,  pitch,  roll,  and  yaw  rate,  stick  and  rudder  pedal  forces, 
and  FCC  and  AIU  temperature.  All  of  these  signals  are  protectively  buffered  so 
that  a  failure  external  to  the  FCC  Complex  will  not  cause  an  internal  malfunction. 


61 


NADC-82240-60 


The  FCC  Complex  interfaces  with  the  avionics  system  via  a  serial-digital,  dual- 
redundant,  time-division  multiplex  data  bus  as  shown  in  Figure  37.  The  FCC 
Complex  responds  as  a  remote  terminal  to  commands  received  on  this  bus. 

The  FCC  Complex  is  designed  to  provide  a  bus  complement  of  32  subaddresses 
of  32  words  each  so  that  up  to  1000  words  of  bus  traffic  is  permitted.  A 
failure  of  an  FCC  will  cause  its  bus  transmitter  to  stop,  and  this  action  will 
force  the  bus  controller  to  transfer  communication  to  the  second  bus  and 
another  FCC.  The  bus  interface  is  designed  so  that  no  failure  external  to  the 
FCC  Complex  will  cause  an  internal  malfunction. 

2.  The  Flight  Control  Computer  (FCC) 

A  layout/outline  drawing  of  the  Bendix  BDX-930  FCC  is  shown  in  Figure  38. 

The  FCC  contains  a  computer  unit  that  contains  a  16-bit  paralleled  twos-comple- 
ment  binary  arithmetic  unit  and  sufficient  memory  to  perform  the  AFTI/F-16 
FCS  functions.  The  BDX-930  FCC  is  faster,  smaller,  and  consumes  less  power 
than  its  predecessors.  It  employs  a  pipeline  organization  feature  to  provide  con¬ 
current  fetch,  decode,  and  execute  operations  in  order  to  increase  the  number  of 
instructions  executed  per  unit  of  time.  All  major  FCC  elements  are  provided  with 
hardware  error  detection  features  to  aid  in  the  failure  isolation  and  fault  recovery 
process. 


FLIGHT 

CONTROL 

COMPUTER 


Figure  37.  Interface  of  the  FCC  Complex  with  the  Dualized  Avionics  Multiplex  Bus 
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The  Central  Processor  Unit  (CPU)  architecture  employs  an  asynchronous  memory 
interface  that  allows  the  CPU  (I/O)  controller,  avionics  MUX  bus,  and  inter  FCC 
data  link  from  loading  down  the  memory  access  bus. 

The  processor  can  perform  single  precision,  double  precision,  and  saturated 
arithmetic  operations.  Saturated  arithmetic  capability  minimizes  fixed-point 
arithmetic  overflow  problems.  All  memory  is  equipped  with  parity,  and  program 
memory  is  accomplished  in  EPROMS  to  preclude  unintentional  alteration.  The 
processor  contains  22  registers  which  are  usable  by  the  programmer. 

The  FCC  contains  an  Input/Output  (I/O)  controller  that  controls  the  I/O  operation 
of  analog  I/O,  discrete  I/O,  and  inter  FCC  serial  data  transmission.  Branch  failure 
partioning  will  permit  a  CPU  failure  to  cause  the  I/O  controller  to  obtain  analog 
and  discrete  inputs  and  to  transmit  these  data  to  the  other  FCC's  so  that  input 
redundancy  is  maintained.  The  analog  I/O  function  is  implemented  with  12-bit 
analog-to-digital  (A/D)  and  digital-to-analog  (D/A)  converters. 

The  FCC  contains  a  serial  data  transmitter  and  two  receivers,  which  are  used  to 
perform  the  inter-FCC  data  exchange.  The  bus  format  is  one  way  communica¬ 
tion  with  a  Manchester  bi-phase  level  code  and  is  accomplished  at  a  1-MHz  bit 
rate.  The  transmitters  and  receivers  contain  hardware  to  verify  the  validity  of 
all  messages  and  to  aid  in  the  failure  isolation  process.  The  bus  structure  will 
support  128  messages  with  up  to  7  data  words  each.  Each  receiver  bus  access 
is  limited  to  1  K  of  RAM  to  prevent  address  errors  from  propagating  into  the 
processor  work  area  and  destroying  in-line  data  computation. 

The  avionics  MUX  bus  interface  employs  a  single  transmitter  receiver,  which  is 
interfaced  directly  with  RAM,  with  access  limited  in  hardware  to  IK  words. 

This  limited  access  feature  also  prevents  MUX  interface  failures  from  propagating 
into  the  FCC.  The  interface  contains  a  tag  timer  that  can  be  reset  by  the  bus 
controller  and  read  by  the  FCC  to  obtain  a  time  correlated  data  set. 

The  FCC  also  contains  considerable  hardware  logic,  which  is  used  in  the  fault 
isolation,  identification,  and  self-testing  process.  This  logic  includes  hardware 
that  permits  two  good  FCC's  to  "shut  down"  a  third  by  mutual  consent  of  the 
two  good  FCC's  without  dependence  upon  any  action  of  the  third  "failed" 

FCC's  processor  or  software  (this  is  first  failure  logic).  The  first  failure  of  an  FCC 
causes  the  issuance  of  a  discrete,  which  enables  (unmasks)  a  self-test  interrupt 
handling  routine.  When  a  second  FCC  failure  is  detected,  the  FCC  that  detects 
the  failure  issues  a  "start  self-test"  interrupt,  which  causes  the  FCC's  to  execute 
the  self  test  routines  in  an  attempt  to  isolate  the  problem.  The  first  FCC  to 
declare  a  self-test  failure  is  "shut  down",  and  the  system  continues  to  operate 
on  the  last  good  FCC  (this  is  second  failure  logic).  Logic  is  wired  so  the  last 
remaining  processor  will  not  be  disconnected  even  if  it  also  "fails"  self  test. 

During  the  early  part  of  the  flight  test  program,  the  DFCS  will  include  a  simple 
triplex  analog  Independent  Backup  Unit  (IBU)  control  system  that  will  auto¬ 
matically  be  engaged  if  both  of  the  remaining  FCC's  either  pass  or  fail  self  test. 

This  feature  is  authorized  only  if  an  IBU  is  installed,  otherwise,  the  failure  logic 
described  above  will  apply. 
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Each  FCC  contains  a  branch  of  analog  electronics  for  the  IBU  function  and  is  used 
as  a  dissimilar  backup  to  the  digital  computation  function,  and  is  used  primarily  to 
protect  against  generic  software  faults  in  the  system.  This  feature  was  added  because 
the  purpose  of  the  AFTI/F-16  program  is  to  provide  a  test  bed  for  new  flight  control 
concepts  and  their  integration  into  a  total  weapons  system.  Since  it  is  a  test  bed,  it 
will  undergo  many  software  modifications.  The  IBU  can  be  engaged  manually  with 
a  switch  on  the  SSC.  The  IBU  is  also  automatically  engaged  whenever  a  second  FCC 
failure  can  not  be  isolated  by  self  test  or  when  all  three  FCC's  have  been  declared 
failed. 

The  FCC's  possess  a  Built-In-Test  (BIT)  capability  for  preflight  and  maintenance 
testing.  The  preflight  BIT  is  capable  of  isolating  failures  to  a  FCS  line  replaceable 
unit  (LRU)  to  a  95%  confidence  level.  No  special  Ground  Service  Equipment  (GSE) 
is  required  and  the  need  for  pilot  participation  is  minimized.  Results  of  tests  are 
shown  on  the  Multi-Purpose  Displays  (MPD).  BIT  pre-flight  testing  functions 
cannot  be  engaged  in  flight.  The  BIT  function  tests  all  software,  sensors,  and 
actuators.  After  the  satisfactory  completion  of  preflight  BIT  the  cockpit  con¬ 
trollers  and  switches  are  tested  as  the  pilot  goes  through  the  normal  "sweeps" 
through  these  devices  while  on  the  ground. 

Automatic  maintenance  BIT  functions  are  identical  to  those  of  the  preflight  BIT. 
Test  results  are  displayed  on  the  MPD's  which  also  provide  a  built  in  "multimeter" 
function.  Fifteen  thousand  test  points  are  automatically  checked  during  the 
maintenance  BIT  procedure  (5000  for  each  FCC).  Manual  test  procedures  can 
be  configured  on  previous  failure  histories.  The  BIT  maintenance  testing  func¬ 
tion  cannot  be  engaged  in  flight.  Table  6  lists  the  salient  features  of  the  FCC's. 


TABLE  6.  SALIENT  FEATURES  OF  THE  BENDIX  BDX-930  FCC 

•  PROCESSOR 

•  16-Bit  Microprocessor 

•  Pipeline  Architecture 

•  22  Usable  Registers 

•  Single  Precision,  Double  Precision 
and  Saturate  Arithmetic 

•  162  Microsec  Benchmark  Program 

•  Expanded  Instruction  Set 

•  MEMORY 

•  Asynchronous  Memory  Control 

•  7k  RAM  Scratchpad 

•  32k  EPROM  Program 

•  64  Words  EAROM  -  Failure  Record 

•  ATTRACTIVE  FEATURES 

•  Analog  IBU  -  Independent  of  Digital  Processor 

•  Self  Contained  DC  Power  Supplies 

•  Two  Real  Time  Clocks 

•  12-Bit  A/D  and  D/A  Converters 
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The  Actuator  Interface  Unit 

The  Actuator  Interface  Unit  (AIU)  shown  in  Figure  39,  houses  those  components 
of  the  FCS  that  are  not  triply  redundant.  These  components  include  the  dual  re¬ 
dundant  Leading-Edge  Flap  (LEF)  interface,  the  fourth  servo-amplifier  for  each 
ISA,  and  several  simplex-to-triplex  Junction  Box  type  of  functions. 

The  caution,  and  warning,  IBU  engage,  and  the  stall  warning  light  drivers  are 
designed  so  that  two  discrete  outputs  are  required  for  illumination.  This  feature 
makes  it  extremely  remote  that  the  lamps  will  be  inadvertently  illuminated  by  a 
failure. 

The  LEF  circuitry  contains  a  switching  matrix  that  is  controlled  by  the  FCC's  to 
determine  which  FCC  is  driving  the  LEF.  The  electronics  also  include  summing 
amplifiers  that  close  the  rate  and  position  loops  around  the  LEF  drive  motors. 

The  rate  and  position  information  is  also  transmitted  to  each  FCC  for  monitoring 
purposes.  Switches  that  deactivate  either  or  both  LEF  drivemotors  are  also 
contained  in  the  AIU. 

A  switching  matrix  driven  by  discrete  outputs  from  the  three  FCC's  is  used  to 
select  which  FCC  drives  the  fourth  servo  amplifier  for  each  ISA  and  to  determine 
which  back-up  ISA  valve  coil  is  driven  by  this  amplifier.  The  valve  current  wrap¬ 
around  is  supplied  to  all  FCC's  to  permit  monitoring. 

The  Junction  Box  functions  of  the  AIU  include  the  conversion  of  ISA  pressure 
switch  positions  and  ISA  positions  from  simplex  to  triplex  form.  The  "pseudo" 
position  of  each  ISA  is  brought  into  the  AIU  where  the  signal  is  demodulated  into 
a  DC  signal  and  then  sent  to  each  FCC  for  ISA  monitoring  purposes.  Figure  40 
shows  the  integration  of  the  AIU  within  the  DFCS. 
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FLIGHT  CONTROL  ACTUATORS 


This  section  describes  the  Integrated  Servoactuators  (ISA's)  that  drive  the  primary  flight  control 
surfaces  and  the  Power  Drive  Unit  (PDU)  assembly  that  actuates  the  Leading  Edge  Flaps  (LEF). 

The  speedbrake  actuators,  part  of  the  secondary  FCS,  do  not  interface  with  any  other  portion  of 
the  primary  or  secondary  FCS  and  therefore  will  not  be  described. 

1.  Integrated  Servoactuators  (ISA) 

Each  of  the  seven  ISA's  (Figure  41)  accept  electrical  commands  from  the  FCC's  in  three  electro- 
hydraulic  servovalves  (EHSV).  These  commands  are  converted  into  a  power-ram  position,  which 
then  positions  the  respective  flight  control  surface.  Actual  ram  position  is  fed  back  to  the  EHSV's 
mechanically  to  close  the  command  loop.  This  mechanical  feedback  concept  provides  for  improved 
surface  position  resolution  and  allows  optimum  ISA  packaging. 

A  schematic  diagram  of  the  ISA  is  shown  in  Figure  42  to  illustrate  the  following  functional 
characteristics: 

•  A  unique  mechanical  position  and  actuator  rate  feedback  scheme  combines  the  feedbacks  into 
a  single  input  to  EHS  J . 

•  Three  EHSV's  are  provided  for  redundancy  purposes.  EHSV  SV1  and  SV2  normally  share 
control  of  actuator  position,  while  the  third  EHSV,  SV3,  is  held  in  standby.  Note  that  flows 
from  SV1  andSV2  flow  to  the  larger  piston,  and  its  chb.  ber,  on  the  main  control  valve.  The 
flows  from  SV1  and  SV2  are  summed  in  the  chamber. 


Figure  41.  Typical  ISA  Used  for  Powering  the  Primary  and  Vertical  Canard  Control  Surfaces 
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•  EHSV  failure  detection  is  accomplished  by  comparing  EHSV  first-stage  pressures. 

•  Self-contained  hydromechanical  failure  detection  and  correction  logic  is  incorporated  for  first 
failures  of  the  EHSV's  or  for  the  hydraulic  system.  A  first  failure  of  SV1  or  SV2  will  cause 
transfer  of  control  to  the  standby  EHSV  SV3.  A  first  failure  of  SV3  will  lock  the  ISA  on  SV1 
and  SV2  control. 

•  Hydraulic  system  failure  correction  is  given  precedence  over  all  EHSV  failures.  EHSV's  SV1 
and  SV2  operate  on  one  hydraulic  system,  and  SV3  operates  on  the  other  hydraulic  system. 

One  hydraulic  system  (System  B)  is  connected  to  pressure  P-j  and  R-|  and  the  other  (System  A) 
is  connected  to  pressures  P2  and  R2. 

•  Fail-safe  capability  is  incorporated  to  allow  the  ISA  to  mechanically  center  upon  receipt  of  an 
electrical  command  to  the  fail-safe  solenoids  from  an  external  electronic  model  and  monitor 
unit. 

In  the  mechanization  of  its  hydraulic- mechanical  redundancy  management,  the  ISA  utilizes  self- 
contained  failure  logic  to  provide  no  less  than  one-failure-operative  performance.  With  the  aid  of 
FCC  monitoring,  the  ISA  provides  two-failure-operative  performance  if  one  of  the  two  failures  is 
electrical.  By  arming  the  outer  loop  monitor,  the  ISA  provides  fail-safe  performance  for  multiple 
failures.  The  voting  procedure  is  described  below: 

1.  Hydraulic  System  Failure  Detection.  Hydraulic  system  voting  logic  is  built  into  the  ISA. 
This  logic  takes  precedence  over  EHSV  voting  logic  and  will  cause  the  ISA  to  select  a  good 
hydraulic  system. 

2.  ISA  EHSV  Failure  Detection.  Each  ISA  uses  three  EHSV's.  Normally,  two  of  these  EHSV's 
(SV1  and  SV2)  share  control  of  actuator  output  position.  If  a  failure  occurs  in  either  of 
these  EHSV's  the  third  EHSV  (SV3)  will  assume  control  of  actuator  output  position. 

3.  Flight  Control  Computer  EHSV  Failure  Detection.  Each  EHSV  has  two  windings,  each  of 
which  has  total  EHSV  command  capability.  These  windings  are  driven  by  the  FCC  in  an 
active  standby  manner  so  that  a  servoamplifier  first  failure  will  be  detected  and  isolated  and 
a  spare  servoamplifier  in  the  AIU  will  be  activated.  This  procedure  will  prevent  the  needless 
activation  of  the  ISA  self-contained  voting  logic  and  the  loss  of  a  level  of  redundancy  in  the 
EHSV  control  network.  Figure  43  shows  the  interface  of  an  ISA  with  the  FCC  complex 
and  how  a  failed  servoamplifier  is  bypassed  and  replaced  with  a  spare  servoamplifier  in  the 
AIU. 

4.  ISA  Position  Versus  Computer  Model  Position.  Each  FCC  models  the  ISA  and  compares 
the  model  output  with  the  ISA  position.  If  the  two  differ  by  a  prescribed  amount  after  a 
time  delay,  then  an  ISA  fail  discrete  signal  is  outputted  to  the  AIU.  This  modeling  and  mon¬ 
itoring  is  accomplished  in  software. 

5.  Mechanical  Centering  and  Locking  of  a  Failed  ISA.  Additional  failure  protection  capability 
is  designed  into  the  ISA  so  that  it  can  be  mechanically  centered  by  bypass  commands  from 
the  FCC's.  These  commands  cause  all  EHSV's  to  be  bypassed  and  allow  a  self-contained 
spring  to  mechanically  command  the  ISA  to  a  predetermined  neutral  surface  position. 
Centering  can  only  occur  if  (1)  the  pilot  has  previously  armed  the  outer  loop  monitor,  and 
(2)  the  outer  loop  monitor  has  determined  that  the  surface  position  is  in  error.  This  action 
prevents  spurious  failure.  The  ISA  should  be  centered  after  failures  of  either  SV1  orSV2, 
and  failure  of  SV3.  A  combined  failure  of  SV1  and  SV2  is  tolerable  provided  that  SV3  and 
Hydraulic  System  A  are  operational. 
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2.  Power  Drive  Unit  (PDU)  Assembly 

The  Power  Drive  Unit  (PDU)  assembly  shown  in  Figure  44  is  comprised  of  the  basic  hydromechanical 
drive  unit  plus  the  following  components: 

•  A  hydraulic  flow-control  valve  and  manifold  to  drive  both  hydraulic  motors. 

•  Flow  limiters  to  limit  speeds  for  low  loads  on  the  LEF. 

•  A  redundant  electromechanical  actuator  to  provide  a  positioning  command  to  the  hydro¬ 
mechanical  drive  unit. 

•  Position  summing  linkage. 

•  Operational  controls. 

Two  in-line  hydraulic  motors  (one  driven  by  each  hydraulic  system)  power  the  LEF.  These  motors 
are  located  on  opposite  sides  of  the  PDU  to  provide  maximum  separation  of  the  two  independent 
hydraulic  systems.  Two  hydraulic  motors,  ganged  together  by  a  common  shaft  and  pinion,  drive  a 
bull  gear.  The  bull  gear,  in  turn,  drives  two  output  shafts;  one  on  the  left  side,  another  on  the  right 
side.  The  shaft  on  the  left  side  contains  gearing  that  drives  a  feedback  arm  through  a  60-degree  arc 
of  the  electromechanical  actuator's  rotating  crank. 

The  shaft  on  the  right  side  contains  an  overtravel  mechanism  that  allows  one  degree  of  additional 
surface  motion  at  each  end  of  the  operating  stroke  of  the  panel.  After  contacting  the  stop,  the  sys¬ 
tem  will  come  to  a  halt  within  two  output  shaft  revolutions  of  the  PDU.  This  safety  feature  provides 
internal  stops  that  prevent  the  LEF  from  being  driven  into  hard  structure  in  the  event  of  a  malfunction 
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Figure  44.  Power  Drive  Unit  (PDU)  Assembly 

in  either  the  control  or  drive  portion  of  the  PDU.  The  positive  stops  consist  of  a  threaded  nut, 
which  moves  inboard  and  outboard  as  the  shaft  rotates,  and  brake  discs  held  with  bellville-type 
washers.  Should  the  PDU  tend  to  overtravel,  the  traveling  nut  engages  the  spring  washers  and  com¬ 
presses  them,  producing  a  clamping  action  that  stops  shaft  rotation  and  stalls  the  motor. 

REDUNDANCY  MANAGEMENT  OF  THE  DFCS 

The  reliability  and  fail-ooerational  requirements  for  the  AFTI/F-16  DFCS  are  listed  as  follows: 

•  Fail  Operation*..  Requirements 

•  First  Failure  —  Undergraded  full  operational  performance 

•  Second  Failure  —  Safe  flight  capability 

—  Fully  operational  (State  1)  performance  95%  probable 

•  Reliability  Requirements 

•  Loss  of  Control  —  1  in  10 ^  flight  hours 

•  Mission  Abort  —  1  in  10^ 

To  fulfill  these  requirements  the  DFCS  must  possess  redundancy  management  techniques  capable  of 
providing  optimum  failure  survivability  via  detection  and  isolation  of  failed  components  to  the  LRU 
level  and  reconfiguring  the  remaining  unfailed  components  to  provide  the  maximum  level  of  aircraft 
safety  and  the  highest  probability  of  mission  completion. 

To  meet  the  fail-operational  and  reliability  requirements  the  DFCS  has  three  voting/monitoring 
planes  as  shown  in  Figure  45.  Two  of  these  planes  are  in  software  and  are  at  the  sensor/controller 
interface  and  the  output  flight  control  surface  command  interface.  The  hardware  voting  plane  is 
located  internally  to  the  ISA's  and  can  be  used  to  isolate  failures  associated  with  the  FCC  output 
circuitry  and  ISA  EHSV  coils  as  well  as  internal  ISA  failures. 
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Figure  45.  Redu-  -fancy  Data  Management  of  Hardware  and  Software  Functions  of  the 
AFTI/F-16  DFCS 

The  general  guidelines  in  evolving  redundancy  management  techniques  are  listed  as  follows: 

•  No  complete  dependence  for  a  FCC  to  recognize  that  it  has  failed  after  performing  a  self-test 
routine. 

•  Minimize  "nuisance”  alarms  by 

—  Placing  maximum  reliance  on  comparison  monitoring 
—  Provide  safeguards  against  transitory  failures 
—  Use  self-test  methods  only  when  required 

•  Implement  a  safe,  dependable  failure  detection  and  identification  scheme. 

•  Provide  a  failure  survival  capability  as  good  as  the  present  F-16  analog  FBW  system. 

The  redundancy  management  technique  are  significantly  different  at  each  of  the  three  voting/ moni 
toring  planes  and  will  therefore  be  discussed  separately. 
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1.  Input  Voting/Monitoring  Plane 

The  primary  purpose  of  the  input  voting/monitoring  plane  is  to  detect  and  isolate  failures  associated 
with  the  sensors,  controllers,  and  input  circuitry.  Redundant  analog  and  discrete  inputs  are  supplied 
to  each  FCC  with  the  required  cross-strap  for  redundant  data  selection  implemented  by  a  serial  data 
exchange  between  FCC's. 

During  normal  (no  failure)  operation  input  data  are  acquired  from  pilot  inputs,  motion  sensors,  and 
ISA  position  signals,  at  a  rate  of  256  samples/second.  The  remaining  FCS  cyclic  input  data  are  ac¬ 
quired  at  a  rate  of  64  samples/second.  These  data  are  sequentially  received  by  the  Input/Output 
Controller  (IOC)  of  an  FCC,  deposited  in  an  area  of  scratchpad  Random  Access  Memory  (RAM) 
dedicated  to  the  IOC,  and  simultaneously  transmitted  to  the  other  two  FCC's.  The  IOC's  are  micro- 
sequenced  controllers  designed  to  operate  independently  of  the  FCC  Central  Processing  Unit  (CPU). 

Whenever  an  FCC  is  declared  failed,  the  redundancy  management  hardware  issues  discretes,  indicat¬ 
ing  the  failure,  to  the  IOC  of  the  failed  FCC  as  well  as  to  other  branches.  The  discretes  cause  the 
IOC  of  the  failed  FCC  to  execute  its  backup  (free  run)  file  and  continue  to  supply  input  data  to  the 
other  FCC  independently  of  any  command  from  the  failed  FCC. 

Each  FCC  performs  input  voting  and  monitoring  on  the  redundant  input  data  deposited  in  its 
scratchpad  memory  by  its  IOC  as  well  as  by  the  IOC's  of  the  other  two  FCC's.  Two  selector/ 
monitor  algorithms  are  used  to  perform  the  input  voter/monitor  function.  One  for  discrete  input 
and  one  for  analog  input  data. 

Discrete  inputs  are  monitored  before  voting  and  one  monitoring  cycle  is  permitted  (persistence) 
before  a  disagreement  is  declared  a  failure.  Discrete  inputs  are  monitored  and  voted  in  digital  packed 
word  form  and  each  digital  word  may  contain  as  many  as  sixteen  discrete  inputs.  Most  discretes  are 
monitored  at  a  rate  of  64  samples/second  but  discretes  affected  by  mechanical  contact  bounce  are 
monitored  at  a  rate  of  13  samples/second. 

The  selector  algorithm  for  discrete  inputs  performs  a  majority  vote  if  the  three  discretes  agree  or  if 
one  of  the  three  disagrees  (a  possible  first  failure  condition).  If  a  first  failure  is  declared  and  the  two 
remaining  discretes  disagree,  (a  possible  second  failure  condition),  the  selector  algorithm  selects  the 
last  value  used  prior  to  the  disagreement.  If  the  disagreement  cannot  be  resolved,  a  failure  is  de¬ 
clared  and  the  most  safe  state  for  the  discrete  is  assumed  and  selected. 

All  analog  input  signals  are  monitored  and  selected.  AOA  and  AOS  signals  are  normalized  and  com¬ 
pensated  for  errors  prior  to  utilization. 

A  good  channel  average  algorithm  operates  on  all  analog  inputs,  (except  AOA  and  pneumatic  Beta 
which  use  a  modified  median  select  algorithm)  and  selects  the  average  value  when  signals  from  either 
two  or  three  good  channels  are  present.  If  any  signal  does  not  track  the  other  two  sensor  signals 
within  a  band  of  tolerances,  that  sensor  signal  is  not  included  in  the  average.  If  a  sensor  signal  does 
track  for  a  number  of  consecutive  frames,  the  failure  management  function  is  called  to  remove  it 
from  the  input  sensor  set.  After  a  first  analog  input  failure,  the  failure  management  function  is 
called  to  resolve  any  disagreement  between  the  last  two  good  channels  (a  possible  second  failure  con¬ 
dition).  If  the  second  failure  can  be  isolated,  the  remaining  good  channel  signal  is  selected.  If  the 
second  failure  cannot  be  isolated,  a  reconfigured  set  of  control  laws  is  provided. 

Reconfigured  control  laws  are  available  for  all  analog  inputs  except  controller  commands.  When 
reconfiguration  is  required  for  the  pilot  sidestick  and  rudder  pedal  inputs,  the  signal  from  the 
appropriate  fourth  force  transducer  on  these  input  devices  is  used. 
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The  averaging  process  associated  with  the  good  channel  average  algorithm  eliminates  sensor  state 
differences.  All  inputs  which  either  change  rapidly  or  are  significant  contributors  to  gain  and  phase 
margins  are  acquired  at  a  rate  of  256  samples/second  to  minimize  data  latency. 

2.  Output  Voting/Monitoring  Plane 

The  output  voting/monitoring  is  accomplished  by  the  ISA  monitor  and  the  LEF  monitor.  These 
monitors  employ  a  combination  of  FCC  software  and  hardware  to  manage  the  output  and  system 
interfaces. 

The  ISA  monitor  is  designed  on  the  assumption  that  all  critical  FCC  and  output  electronic  failures 
can  be  detected  by  compiling  the  coil  currents  (obtained  via  analog  wraparounds)  which  drive  the 
three  EHSV's  in  each  of  the  seven  ISA's.  Because  of  the  number  of  ISA's  and  the  complexity  of  the 
monitoring  scheme  the  ISA  monitoring  function  is  broken  into  a  subframe  ISA  monitor  which 
executes  every  8  milliseconds  and  a  Frame  Cyclic  ISA  monitor  which  executes  once  per  frame  (16 
milliseconds). 

The  subframe  ISA  monitor  is  given  the  task  of  comparing  the  coil  currents  of  the  primary  ISA  coils. 
With  no  failures  in  the  system  FCC  A  drives  the  primary  coil  of  SV1,  FCC  B  drives  the  primary  coil 
of  SV2,  and  FCC  C  drives  the  primary  coil  of  SV3  with  the  average  displacement  of  SV1  and  SV2 
actually  driving  the  surface  via  the  primary  hydraulic  system  (see  Figure  43).  An  erroneous  com¬ 
mand  from  an  FCC  or  a  failure  of  the  output  electronics  (D/A,  sample  and  hold,  servoamplifier,  or 
primary  coil)  will  cause  a  difference  to  exist  between  the  three  primary  coil  currents.  Each  FCC 
(if  not  the  cause  for  the  difference)  is  capable  of  isolating  the  failure  to  a  particular  branch.  If  an 
FCC  determines  that  its  coil  current  is  erroneous  the  output  electronics  are  disconnected  and  a 
backup  coil  current  is  supplied  using  the  fourth  servoamplifier  driven  from  a  different  branch.  If 
this  procedure  is  accomplished  successfully  the  other  two  FCC's  allow  the  partially  failed  branch  to 
remain  on  line.  If  the  branch  with  the  failure  does  not  disconnect  the  primary  coil,  the  other  two 
branches  will  totally  disconnect  the  failed  branch.  The  task  of  isolating  this  failure  to  either  a  com¬ 
puted  output  failure  or  an  output  electronics  failure  is  left  to  the  ISA  frame  cyclic  monitor  for 
first  failures. 

The  Subframe  ISA  monitor  becomes  quite  complicated  after  a  first  failure  has  been  detected  and 
isolated.  The  resulting  system  actions  are  dependent  on  the  cause  of  the  first  failure  (output  elec¬ 
tronics  or  erroneous  FCC  output),  the  cause  of  the  second  failure,  whether  or  not  the  first  or  second 
failure  affected  one  or  all  coil  currents,  and  which  branches  sustained  the  failures. 

The  Frame  Cyclic  ISA  monitor  is  allocated  the  tasks  of  monitoring  the  backup  (or  4th)  ISA  servo- 
amplifiers,  handling  the  automatic  reengagement  of  primary  servoamplifiers  which  have  been  taken 
off  line  due  to  a  transient  condition,  monitoring  the  ISA  centering  and  pressure  system  discretes, 
monitoring  the  computed  ISA  commands  after  a  first  output  electronics  failure,  and  controlling  the 
activation  and  computations  associated  with  the  ISA  model  which  can  be  engaged  after  an  ISA 
mechanical  or  hydraulic  system  failure. 

The  LEF  monitor  performs  cross-channel  monitoring  on  the  LEF  commands,  position  transducer 
signals,  and  LEF  motur  rates.  The  LEF  monitor  also  contains  a  digital  model  of  the  LEF  actuation 
system.  The  digital  model  is  modified  to  reflect  full  or  half  speed  drive  as  a  function  of  the  LEF 
failure  state. 
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a.  Failure  Detection,  Isolation,  and  Reconfiguration  After  Single  and  Dual  FCC  Failures 


As  stated  previously  each  FCC  receives  the  ISA  commands  of  the  other  FCC's  via  the  intercomputer 
data  link.  Each  FCC,  by  comparison  monitoring  of  ISA  commands  decides  if  another  FCC  was 
failed  in  any  (or  all)  of  its  ISA  commands.  For  the  single  failed  FCC  situation  we  will  assume  that 
FCC  A  experienced  a  failure.  FCC  A  is  expected  to  detect  its  own  failures  by  comparing  actual  ISA 
position  with  that  of  the  model  ISA's,  and  shut  itself  down  if  these  values  disagree.  FCC  B  and 
FCC  C  monitor  FCC  A's  ability  to  monitor  itself. 

If  FCC's  B  and  C  detect  a  failure  of  one  (or  more)  of  FCC  A's  ISA  commands,  they  wait  to  see  if 
FCC  A  identifies  the  failure  and  takes  appropriate  action. 

If  FCC's  B  and  C  receive  intelligence  via  the  inter  FCC  data  link  that  FCC  A  has  taken  the  proper 
action,  then  FCC's  B  and  C  take  no  action. 

If  however,  FCC's  B  and  C  do  not  receive  intelligence  that  FCC  A  has  taken  the  appropriate  action 
(in  connection  with  an  FCC  A  failure  they  have  detected)  then  they  assume  that  FCC  A  has  failed 
and  should  be  switched  out  or  isolated  from  the  system.  In  this  case,  FCC's  B  and  C  send  a  discrete 
to  FCC  A  to  indicate  a  failure.  If  both  FCC  B  and  C  send  such  a  discrete,  then  discrete  failure  logic 
in  FCC  A  switches  FCC  A  out  of  the  system.  The  failure  discrete  which  FCC's  B  and  C  send  to 
FCC  A  is  not  associated  with  a  particular  ISA,  but  rather  implies  a  failure  of  FCC  A  as  a  whole. 

The  sequence  of  events  which  take  place  after  a  second  FCC  failure  (FCC  B  or  FCC  C)  will  now  be 
discusesd. 

If  both  FCC's  (B  and  C)  detect  a  failure  in  a  particular  ISA  command,  then  both  FCC's  revert  to 
previous  value  of  the  appropriate  ISA  command.  Both  FCC's  will  initiate  self-test  procedures.  When 
the  "failed  FCC"  is  identified  it  is  switched  out  of  control  of  the  affected  ISA. 

If  only  one  of  the  two  remaining  FCC's  detects  a  failure,  then  both  FCC's  revert  to  previous  values 
for  all  ISA  commands.  Both  FCC's  initiate  the  self-testing  procedures.  When  "failed  FCC"  is  ident¬ 
ified,  it  is  switched  out  of  control  of  all  ISA's. 

If  both  of  the  last  two  FCC's  fail  self-test,  then  the  first  to  respond  controls  the  FCC  switching.  The 
self-test  sequence  is  arranged  in  priority  order. 

If  neither  of  the  last  two  FCC's  fail  self-test,  but  one  FCC  does  not  complete  it  (no  pass  or  fail), 
then  it  is  designated  the  failed  FCC. 

If  neither  of  the  last  two  FCC's  fail  self-test,  and  no  other  information  is  available  for  the  decision, 
then  one  is  arbitrarily  designated  the  failed  FCC  based  on  a  predetermined  hierarchy. 

If  a  second  FCC  failure  is  not  isolated  then  the  IBU  is  engaged.  The  IBU  is  also  automatically  engaged 
whenever  all  three  FCC's  indicate  that  they  have  failed. 

3.  Output  ISA  Voting/Monitoring  Plane. 

The  primary  purpose  of  the  ISA  voting/monitoring  plane  is  to  detect  and  isolate  mechanical  and 
hydraulic  failures  internal  to  the  ISA.  Since  the  ISA's  are  driven  by  a  dual-redundant  hydraulic 
system,  they  are  designed  to  provide  a  fail-operate  capability.  In  order  to  provide  this  capability,  a 
first  failure  upstream  of  the  ISA  must  be  isolated  before  the  ISA  voter/monitor  will  detect  this 
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same  failure.  The  ISA  monitor  will  declare  a  failure  in  approximately  20  to  40  milliseconds;  there¬ 
fore,  the  upstream  monitors  must  remove  a  failure  before  this  time  limit.  Because  of  this  time  limit, 
the  upstream  voter  monitors  will  remove  the  failure  on  the  first  detection  and  will  initiate  the 
proper  corrective  action  but  not  declare  a  failure  for  several  cycles.  This  latency  is  desired  because 
it  reduces  the  tendency  of  the  DFCS  to  declare  hard  failures  during  transient  or  nuisance  failure 
conditions. 

FLIGHT  CONTROL  SYSTEM  SELF-TEST 

Flight  Control  System  (FCS)  self-test  capability  can  be  viewed  as  consisting  of  four  tiers  of  tests  of 
increasing  complexity  and  fault  isolation  coverage.  These  tests  include  (in  order  of  increasing  com¬ 
plexity)  the  following; 

•  Inflight  Integrity  Management  (IFIM) 

•  Inflight  Self-Test 

•  Preflight  BIT 

•  Maintenance  BIT 

1.  Inflight  Integrity  Management  (IFIM) 

IFIM  is  active  whenever  power  is  supplied  to  the  FCS  and  is  used  to  protect  against  only  those 
failures  which,  if  they  occur  in  flight,  would  have  a  direct  effect  on  FCS  performance  and/or  cause 
a  reduction  in  the  redundancy  level  of  the  system. 

The  primary  IFIM  mechanisms  are  in  the  three  voting/monitoring  planes  previously  described.  When 
failures  are  detected  at  these  planes  by  the  cross-channel  monitors  and  persist,  the  pilot  is  informed 
of  the  failure  by  means  of  caution  or  warning  lights  and  by  a  message  on  the  Multi-Purpose  Display 
(MPD).  By  keying  up  the  FCS  fault-report  page  on  the  display,  the  pilot  will  be  informed  of  the 
exact  failure  which  has  occurred  and  can  attempt  a  reset.  A  reset  command  will  attempt  to  clear  the 
failure  which  is  on  the  MPD  and  has  the  effect  of  restoring  the  redundancy  by  one  level.  Thus  a 
reset  of  a  second-like  failure  only  resets  the  second  failure  and  cannot  foil  the  voting  algorithm.  If 
a  reset  is  successful,  the  appropriate  message  will  disappear  from  the  MPD  and  the  lights  will  be 
extinguished. 

IFIM  also  includes  several  hardware  monitors  which  are  also  continuously  active.  These  monitors 
perform  the  following  functions: 

•  Monitoring  of  electrical  power  which  will  produce  a  high  priority  vectored  interrupt  in  case  of 
power  failure. 

•  Watchdog  timer  function  which  disengages  FCC  outputs  in  case  of  major  FCC  failures. 

•  Monitoring  of  the  word  count  and  fresh  data  flags  on  the  Avionics  and  inter-FCC  MUX  bus 
receivers. 

•  Monitoring  of  fresh  data  flags  on  A/D  converter  outputs. 

The  purpose  of  these  hardware  monitors  is  to  declare  a  single  hardware  failure  instead  of  a  multitude 
of  input  or  system  failures  as  would  be  the  case  if  only  the  selector/monitors  were  employed.  The 
information  from  these  hardware  monitors  in  conjunction  with  the  failure  information  supplied  by 
the  selector/monitors  is  used  by  a  software  routine  called  the  "failure  manager"  to  determine  what 
failure  message  is  supplied  to  the  MPD's. 
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2.  Inflight  Self-Test 

Inflight  self-tests  include  hardware  tests  which  are  always  active,  software  cyclic  tests,  and  tests 
which  are  event-driven  (usually  a  failure).  A  failure  detected  by  these  tests  is  always  recorded  by 
the  FCC  and  transmitted  via  the  MUX  bus  to  the  instrumentation  system  but  does  not  necessarily 
result  in  a  failure  indication  to  the  pilot. 

Hardware  self-tests,  which  are  always  active,  include  memory  parity  on  all  FCC  memory  and  parity 
checks  on  all  MUX  bus  receivers.  A  memory  parity  failure  causes  a  processor  interrupt  and  executes 
a  software  routine  which  records  the  failed  Icoation  for  later  retrieval.  Parity  errors  on  transmissions 
are  used  to  alert  the  FCC  not  to  depend  on  the  data  received  during  that  cycle. 

CPU  self-test,  RAM,  and  ROM  tests  are  event-driven  and  are  executed  in  the  air  only  after  a  second- 
like  failure  is  detected  at  the  output  monitor  plane  or  on  the  ground  by  a  higher  level  test. 

3.  Preflight  BIT 

Preflight  BIT  includes  all  I  FI M  and  inflight  self-tests  plus  additional  FCC  tests  and  testing  of  LRU's 
external  to  the  FCC.  Preflight  BIT  is  initiated,  controlled,  and  monitored  via  the  MPD's.  The  tests 
are  performed  by  the  FCC  resident  Operational  Flight  Plan  (OFP)  and  can  only  be  initiated  on  the 
ground  (interlocked  by  appropriate  discrete  inputs). 

When  power  is  applied  to  the  FCS,  all  FCC's  are  in  the  IBU  mode  and  will  start  executing  flight  con¬ 
trol  laws  associated  with  the  NORMAL  multimode  when  brought  on  line,  with  IFIM  and  inflight 
self-tests  operational,  and  with  the  corresponding  NORMAL  mode  display.  The  pilot  will  then  check 
his  failure  lights  and  fault-report  display  and  then  initiate  preflight  BIT. 

The  preflight  BIT  display  lists  all  manual  tests  which  are  still  pending  (not  yet  performed)  and  fail¬ 
ure  codes  for  all  tests  which  were  not  passed. 

4.  Maintenance  BIT 

Maintenance  BIT  adds  non-structured  tests  to  those  performed  by  preflight  BIT  in  order  to  check 
out  the  FCS  after  maintenance  or  modification  or  as  an  aid  in  failure  isolation  to  an  LRU.  All 
maintenance  BIT  tests  are  designed  to  use  an  assumed  healthy  FCC  to  find  faults  in  exterior  inter¬ 
faces  or  equipment 

Maintenance  BIT  essentially  turns  the  MPD's  into  remote  computer  terminals  which  allow  the  op¬ 
erator  to  look  at  the  contents  of  any  memory  location  in  all  three  FCC's  simultaneously  and  then 
use  an  MPD  as  a  multimeter.  For  example,  the  operator  could  key  in  the  memory  location  cor¬ 
responding  to  left  AOA,  have  a  technician  position  the  transducer  to  a  predetermined  position,  and 
then  determine  if  all  electrical  inputs  were  received  by  each  FCC  properly  with  the  correct  sign  and 
within  magnitude  tolerances.  By  proper  test  selection,  the  operator  can  check  out  any  system  mod¬ 
ification  or  isolate  failures  to  an  LRU. 

INDEPENDENT  BACK-UP  UNIT  (IBU) 

To  provide  an  independent  backup  capability,  a  very  simple  analog  Independent  Backup  Unit  (IBU) 
was  developed.  The  IBU  provides  stability  augmentation  and  control  in  pitch  and  direct  flight  con¬ 
trol  surface  control  in  roll  and  yaw.  A  block  diagram  of  the  IBU  is  shown  in  Figure  46. 
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The  design  philosophy  for  the  I8U  is  to  provide  a  simple  controller  and  ensure  safe  flight.  Per¬ 
formance  requirements  of  the  IBU  are  to  meet  Level  3  requriements  of  MIL-F-8785  (ASG)  for 
cruise  and  descent  and  Level  2  for  landing.  Control  in  the  longitudinal  axis  is  provided  by  a  pitch- 
rate  command  system.  The  pitch  command  from  the  stick  is  shaped  and  then  lagged  by  a  prefilter. 
The  pitch  rate  error  signal  is  then  gained  and  fed  through  a  proportional-plus-integral  network.  Dif¬ 
ferent  lead/lag  compensators  for  the  gear-up  and  gear-down  configurations  augment  stability  margin 
and  improve  handling  qualities  over  the  entire  flight  envelope.  The  forward  loop  integrator  is  not 
driven  when  the  IBU  is  not  engaged.  The  integrator  is  driven  when  the  IBU  is  engaged  and  there  is 
no  weight  on  wheels.  In  order  to  minimize  engagement  transients,  the  integrator  is  also  driven  when 
the  digital  system  is  operating,  but  a  self-test  is  being  carried  out  If  the  IBU  is  engaged,  the  inte¬ 
grator  is  discharged  when  there  is  weight  on  the  main  landing  gear.  Direct  aileron  control  is  used  in 
the  lateral  axis.  The  command  signal  from  the  rudder  pedal  is  simply  passed  through  a  shaping 
gradient  function.  Fixed  biases  are  provided  to  drive  the  trailing-edge  flaps.  With  the  landing  gear 
up,  the  flaps  are  driven  to  0  deg.  The  leading-edge  flaps  are  not  driven  by  the  IBU,  but  are  simply 
locked  once  the  IBU  is  engaged.  Analysis  has  shown  that  the  IBU  satisfies  Level  3  flying  qualities 
for  cruise  and  descent  and  Level  2  for  landing.  Stability  margins  in  the  pitch  axis  are  adequate  over 
the  flight  envelope.  Pilot-in-the-loop  simulation  has  shown  that  the  IBU  provides  capability  for  a 
safe  return  to  base  and  landing  for  emergency  situations. 

DFCS-ELECTRICAL SYSTEM  INTERFACE 

The  FCS  will  receive  electrical  power  from  two  essential  28  VDC  buses,  backed  up  by  four  batteries, 
a  5kVA  emergency  generator,  and  a  500  VA  permanent  magnet  generator.  The  electrical  system 
will  provide  uninterruptable,  regulated  power  regardless  of  transient  voltages  or  fault  conditions 
elsewhere  in  the  airplane  system.  This  input  power  will  be  provided  to  each  branch  of  the  FCS 
where  it  will  be  finally  converted  and  regulated  to  produce  the  800  Hz  AC  and  the  DC  voltages  to 
power  the  DFCS.  Figure  47  illustrates  the  AFTI/F-16  DFCS  redundancy  concept.  Column  3  of  this 
figure  illustrates  how  the  primary  40  kVA  generator  is  backed  up. 

A  schematic  diagram  of  the  AFTI/F-16  Electrical  Power  System  is  shown  in  Figure  48. 

Note  that  each  of  the  two  essential  28  VDC  busses  receives  its  power  from  a  dedicated  1 1 5/200 
VAC-to-28-VDC  converter.  Each  converter  may  receive  input  power  from  either  the  40-kVA 
primary  generator  of  the  Emergency  Power  Unit  (EPU)  5-kVA  generator.  The  EPU  is  driven  by 
engine  high-pressure  bleed  air  in  the  event  of  improper  generator  voltage  or  frequency.  Should  both 
the  40  kVA  primary  generator  and  the  5  kVA  emergency  generator  fail  to  supply  power  to  each  one 
of  the  28  VDC  converters,  then  the  Permanent  Magnet  Generator  (PMG)  portion  of  the  EPU's 
emergency  generator  supplies  18-volt,  3-phase,  1,200  Hz,  power  to  a  third  converter  dedicated 
wholly  for  FCS  power  supply  usage.  Furthermore,  this  converter  supplies  power  to  the  EPU's 
electronic  controller  so  that  continued  operation  of  the  EPU  is  assured  (a  "boat-strap”  type  of 
arrangment). 

Multiple  power  sources  preclude  loss  of  power  to  the  battery  buses  because  of  a  malfunction  in  the 
input  power  system.  The  24-volt  batteries  (18  cell,  Ni-Cad  type)  prevents  power  interruptions  dur¬ 
ing  power  source  switching  operations. 

The  electrical  power  supply  system  does  not  provide  any  "turn-off"  capability  to  the  pilot.  How¬ 
ever,  provisions  are  included  for  shutting  off  electrical  power  to  the  FCS  while  the  airplane  is  on  the 
ground.  Ground  "shut-off"  provisions  are  desirable  from  the  standpoint  of  equipment  life  and  re¬ 
liability  so  that  the  FCS  need  not  be  energized  during  routine  maintenance  operations. 
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Figure  48.  AFTI/F-16  DFCS  Electrical  Power  System 
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DFCS-HYDRAULIC  SYSTEM  INTERFACE 

Flight  control  surface  actuation  is  dependent  entirely  upon  the  successful  operation  of  the  hydrau¬ 
lic  system.  The  AFTI/F-16  hydraulic  system  consists  of  two  separate  and  independent  systems 
that  supply  hydraulic  power  for  operation  of  the  primary  flight  control  surfaces,  the  vertical  ca¬ 
nards,  LEF,  speed  brake,  landing  gear,  nose  wheel  steering,  wheel  brakes,  fuel  flow  proportioner, 
and  other  utility  functions. 

A  block  diagram  of  the  hydraulic  system  is  shown  in  Figure  49.  The  major  elements  of  the  hydrau¬ 
lic  system  consist  of  the  following  elements: 

•  Two  main  hydraulic  pumps 

•  An  emergency  hydraulic  pump 

•  Hydraulic  reservoirs 

•  Seven  flight  control  ISA's. 

DFSC-AVIONICS  SYSTEM  INTERFACES 

The  DFCS  and  certain  elements  of  the  avionics  system  (see  Figure  50)  will  be  operated  in  aggregate 
to  provide  the  integrated-DFCS-demonstrator  functional  capability.  As  shown  in  Figure  50  the 
DFCS  is  comprised  of  the  FCC  complex,  inertial  sensors,  cockpit  controllers,  the  ISA's  and  LEF 
actuators,  the  AIU,  and  the  FCS  control  panel.  The  avionics  system  elements  used  to  provide  the 
principal  Pilot/Vehicle  Interface  (PVI)  for  DFCS  mode  control  and  status  annunication  include  the 
following: 


•  Two  interactive  Multipurpose  Display  (MPD's). 

•  Two  Programmable  Display  Generators  (PDG's). 

•  A  dual  redundant  Stores  Management  Set  (SMS)  Control  Interface  Unit  (CIU). 

•  A  redundant  multiplex  (MUX)  data  bus. 

•  Primary  and  backup  MUX  data  bus  controllers. 

The  primary  avionics  MUX  bus  controller  will  be  the  Fire  Control  Computer  (FCC),  and  the  back¬ 
up  bus  control  will  be  provided  by  the  SMS. 

Figure  51  shows  some  of  the  avionic  type  components  that  the  DFCS  will  interface  with  via  the 
avionics  and  display  multiplex  buses.  The  safety  of  the  AFTI/F-16  aircraft  and  the  fail-safe  integ¬ 
rity  of  the  FCS  will  not  be  affected  by  failures  of  the  dual  avionics  bus  or  any  of  the  interfaced 
equipment. 

The  DFCS/avionics  functional  interface  provides  the  following  benefits: 

•  Data  entry  capability. 

•  Display  of  mode  requested/mode  status. 

•  Status  and  fault  reporting. 

•  Built-in  test  capability. 


Figure  52  illustrates  some  of  the  payoffs  obtained  by  optimal  integrations  of  the  avionics  systems 
and  the  DFCS. 
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Figure  49.  Hydraulic  System  Functional  Block  Diagram 
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Figure  50.  DFCS  and  Interface  with  Avionics 
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Figure  51.  AFTI/F-16  Avionic  Components 


Figure  52.  AFTI/F-16  Avionics/DFCS  Integration  Technology  Payoffs 


87 


NADC-82240-60 


PILOT/VEHICLE  INTERFACE  (PVI) 

The  AFTI/F-16  crew  station  is  shown  in  Figure  53.  This  arrangement  was  established  to  provide  an 
effective  Pilot/Vehicle  Interface  (PVI)  co  -istent  with  the  multimode  task  -  tailored  FCS  design 
philosophy.  Cockpit  Controlled  Control/D  isp  I  ay  System  implementation  is  based  on  mission  task 
requirements. 

1.  Cockpit  Controllers 

The  operation  of  the  cockpit  controllers  will  now  be  reviewed.  In  the  pitch  axis  the  SSC 
always  commands  normal  acceleration  so  that  command  ambiguity  is  removed.  The  de¬ 
coupled  direct  lift  SSC  commands  generate  coupled  normal  acceleration  response  after 
the  flaps  reach  maximum  deflection.  This  provides  the  pilot  with  full  authority  control 
of  normal  acceleration.  Manual  vernier  control  of  pitch  pointing  and  vertical  translation 
is  accomplished  using  the  left  hand  controller  (Linear  Throttle),  a  unique  twist  grip  con¬ 
troller  physically  integrated  with  the  throttle  grip  assembly. 

The  SSC  lateral  force  commands  roll  rate  at  all  times.  For  the  standard  operation,  the 
rudder  pedals  command  the  following: 

•  Conventional  rudder  deflection  with  stability  augmentation  in  the  normal  mode. 

•  Direct  side  force  (flat  turn)  in  all  of  the  combat  modes. 

In  the  decoupled  operations,  the  rudder  pedals  command  decoupled  motions  that  are 
in  concert  with  the  pitch  axis  control  and  are  task  oriented. 

2.  Control/Display  System  (CDS) 

The  AFTI/F-16  DFCS  is  designed  to  provide  integrated  control  for  changing  mission  seg¬ 
ments  with  a  single  stroke  of  one  of  several  keys  integrated  within  the  Cockpit/Display 
System  (CDS).  The  CDS  is  designed  to  accomplish  the  PVI  function  in  a  manner  which 
permits  effective  mode  selection.  The  CDS  provides  the  capability  for  integrating  multi¬ 
ple  equipment  control  functions  and  displays  on  a  single  panel.  In  addition,  the  CDS 
has  the  capability  to  automatically  configure  the  avionics  and  DFCS  upon  selection  of  a 
particular  mission  phase. 

The  CDS  consists  of  a  Head-Up  Display  (HUD),  two  interactive  Multipurpose  Display 
(MPD),  and  dedicated  cockpit  switches  (see  Figure  53).  The  MPD's  provide  control/ 
display  /status  functions  for  the  avionics  and  the  DFCS. 

The  CDS  provides  redundant  DFCS/  avionics  interfaces  in  the  DFCS  safety-critical  paths 
to  ensure  flight  safety.  These  interfaces  are  single-failure  tolerant  so  that  no  one  failure 
in  the  MPD's/DFCS  interface  will  decrease  the  number  of  functions  controlled  through 
the  MPD's.  Display  symbology  and  formats  provide  the  information  required  by  the 
pilot  to  effectively  perform  mission-related  tasks. 

Figure  54  shows  the  flight  control  options  displayed  on  the  left  MPD. 
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Figure  54.  Flight  Control  Options  Displayed  On  MPD. 

From  the  flight  control  standpoint  a  single  stroke  of  one  of  the  keys  shown  will  perform  the 
following  functions: 

•  Enables  the  MPD  to  present  the  pertinent  mode  information. 

•  Commands  the  FCC's  to  execute  the  control  laws  optimized  for  the  mission  segment. 

•  Enables  the  preselected  manual  6  DOF  modes  on  the  left  hand  controller  (throttle  grip)  and 
the  rudder  pedals. 

•  Presents  the  proper  symbology  on  the  Radar/EO  and  HUD  displays. 

The  pilot  can  then  engage  or  disengage  the  selected  decoupled  mode.  The  6  DOF  modes  imple¬ 
mented  may  be  modified  at  any  time  by  pressing  the  appropriate  switches  on  the  MPD.  Pressing 
the  "PRSET"  key  will  cause  the  display  shown  in  Figure  54  to  be  presented. 

By  use  of  the  MPD,  the  pilot  can  select,  by  flight  control  mode,  any  of  the  following  options: 

CONTROLLER  OPTIONS 


•  Side  Stick  Controller  (SSC) 

•  LH  Controller  (on  throttle  grip) 

•  Rudder  Pedals 


•  Flight  Path  Maneuver  Enhancement 

•  Pitch  Rate  Maneuver  Enhancement 

•  Pitch  Pointing 

•  Vertical  Translation 

•  Direct  Normal  Force  (Direct  Lift) 

•  Direct  Sideforce  (flat  turn) 

•  Yaw  Pointing 

•  Lateral  Translation 

•  Blended  Pointing 
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THE  ADVANCED  FLIGHT  CONTROL  MODES  OF  THE  AFTI/F-16 

The  AFTI/F-16  is  intended  to  provide  superior  flying  qualities  by  incorporation  of  the  ability  to 
tailor  aircraft  response  to  a  particular  mission  segment  and  by  the  utilization  of  vertical  canards 
and  maneuvering  flaps  to  further  enhance  mission  effectiveness.  Conventional  non-multimode 
designs  generally  result  in  a  compromise  between  smooth  ride  and  good  handling  qualities.  The 
AFTI/F-16  FCS  will  be  designed  to  void  this  compromise  by  emphasizing  tracking  and  handling 
qualities  during  attack  mission  phases  and  ride  qualities  elsewhere. 

1.  The  Four  Major  Flight  Control  Modes  - 

The  AFTI/F-16  DFCS  demonstration  vehicle  will  be  provided  with  four  major  flight  control  modes 
and  decoupled  CCV  modes  utilizing  redundant  control  surfaces  in  each  control  axis,  (Figure  55), 
which  can  be  selected  in  any  pitch  and  yaw  combination  to  tailor  aircraft  to  the  mission.  The  major 
modes  are  as  follows: 

•  Normal  Mode  -  The  normal  mode  is  used  throughout  the  applicable  flight  envelope  for  takeoff, 
cruise,  and  landing  and  for  the  performance  of  secondary  mission  tasks,  such  as  air  refueling 
and  formation  flying.  The  mode  is  designed  to  provide  smooth  ride,  gust  alleviation,  and  re¬ 
duction  of  pilot  workload  during  secondary  mission  segments. 

•  Air-to-Air  Gunnery  (AAG)  Mode  -  The  air-to-air  gunnery  mode  is  used  throughout  the  air 
combat  flight  envelope  to  provide  rapid  maneuvering  during  target  intercept  and  precise  track¬ 
ing.  Control  law  design  strategy  for  this  mode  is  based  on  optimizing  tracking  characteristics. 
The  pilot  is  then  able  to  quickly  null  target  tracking  error  while  he  obtains  improved  handling 
qualities  by  using  the  trailing-edge  flap  as  a  longitudinal  control  surface.  The  resultant  opti¬ 
mized  response  is  then  applicable  to  a  wide  variety  of  air-to-air  target  acquisition  and  tracking 
tasks. 

•  Air-to-Surface  Gunnery  (ASG)  Mode  -  The  air-to-surface  gunnery  mode  will  provide  rapid  and 
precise  pointing  for  increased  accuracy  and  survivability  when  ground  targets  are  being  strafed. 
Design  criteria  used  to  null  target  tracking  error  are  the  same  as  those  developed  for  the  air-to- 
air  mode,  with  additional  emphasis  placed  on  improving  gust  alleviation  response. 

•  Air-to-Surface  Bombing  (ASB)  Mode  -  The  bombing  flight  path  mode  will  provide  precise  con¬ 
trol  of  the  aircraft  flight  path  and  will  improve  gust  alleviation  to  facilitate  bombing  accuracy 
and  to  enable  the  employment  of  effective  control  strategies  in  order  to  increase  aircraft 
survivability. 

Figures  56  thru  59  inclusive  illustrate  how  these  modes  are  executed  by  the  pilot. 

2.  The  Control  Configured  Vehicle  (CCV)  Modes. 

Adjunct  CCV  modes  preselected  through  the  display  subsystem  and  featuring  control  inputs  through 
the  twist-grip  throttle  and  the  rudder  pedals  will  provide  added  capabilities.  These  modes  include 
vertical  and  horizontal  translation,  pointing,  and  direct  force.  Any  longitudinal  and  lateral  combina¬ 
tion  of  adjunct  modes  may  be  selected  translation  may  be  used  with  the  mode.  For  example,  vertical 
and  horizontal  translation  may  be  used  with  the  normal  mode  for  formation  flying;  longitudinal 
pointing  and  lateral  direct  force  may  be  used  to  augment  the  air-to-surface  gunnery  mode.  Domin- 
nant  features  of  the  standard  and  decoupled  DFCS  multimodes  are  summarized  separately  for  pitch 
and  lateral-directional  control  in  Figures  60  and  61. 
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Figure  56.  The  Normal  Mode 
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Figure  57.  Air-to-Air  Gunnery  (AAG)  Mode 
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3.  Control  Law  Design  Methodology 

The  AFTI/F-16  multimode  flight  control  laws  are  structured  to  provide  both  standard  conventional 
control  and  decoupled  control.  The  standard  controi  characteristics  are  tailored  for  maneuvering 
flight  and  target  acquisition,  and  the  decoupled  control  characteristics  are  tailored  to  vernier  track¬ 
ing  and  small-amplitude-weapon  delivery -error  removal.  High  performance,  unique  maneuverability, 
rapid  pitch  and  roll  response,  neutral  speed  stability,  turn  coordination,  departure  prevention,  high 
angle-of-attack  (AOA)  performance,  and  high  AOA  command  limiting  are  major  design  considera¬ 
tions  in  the  development  of  AFTI/F-16  multimode  control  laws.  Flying  quality  requirements,  such 
as  MIL-F-8785B  and  suggested  revisions  thereto,  have  been  developed  for  use  in  the  design  of  con¬ 
ventional  aircraft  and  will  be  satisfied  by  the  AFTI  vehicle  in  the  conventional  modes.  Since,  by 
use  of  these  criteria,  decifiencies  have  been  discovered  in  accurately  predicting  pilot  ratings  and 
tracking  characteristics  for  the  high-order  system  associated  with  highly  augmented  aircraft,  addi¬ 
tional  criteria  —  such  as  C*,  D*,  Neal-Smith,  and  the  newly  developed  step-target  tracking  techniques 
—  were  used  to  compare  designs.  Six-degree-of-freedom  simulation  results  will  provide  the  final  test 
and  acceptance  criteria  for  all  modes  before  flight  testing. 

This  multimode  design  flexibility  allows  the  DFCS  designer  to  establish  gains,  feedbacks,  and  com¬ 
pensation  parameters  not  only  as  a  function  of  flight  condition,  but  also  as  a  function  of  the  mode 
selected.  The  system  performance  can  then  be  tailored  to  match  the  desired  characteristics  of  a 
specific  task  at  hand,  e.g.,  air-to-air  combat,  air-to-surface  bombing,  etc.  Besides  the  design  flexi¬ 
bility  obtained  with  a  multimode  system,  die  AFTI/F-16  vehicle  utilized  the  trailing-edge  flap  as  an 
additional  control  surface  (along  with  the  horizontal  tail)  in  the  longitudinal  axis  to  enhance  its 
performance  capability.  The  flap  used  in  conjunction  with  the  horizontal  tail  can  produce  changes 
in  the  lift  vector  without  the  corresponding  rotation  of  the  aircraft,  characteristic  of  systems  using 
only  the  horizontal  tail  for  control.  The  motions  of  both  flap  and  tail  can  be  coordinated  by  proper 
control  system  design  to  provide  maneuver  enhancement,  decoupled  motions,  and  gust  alleviation 
to  the  aircraft. 

The  four  basic  task-tailored  modes  significantly  affect  the  inner-loop  design  of  the  flight  control 
system.  It  should  be  evident  from  examining  Figures  60  and  61  that  the  modes  can  also  be  cate¬ 
gorized  by  the  influence  on  performance  of  aircraft  flight  path,  as  in  the  Normal  and  Bombing 
Modes,  or  aircraft  attitude  as  in  the  Air  Combat  and  Strafe  modes.  This  influence  is  manifested  in 
the  flight  control  system  design  by  controlling  the  normal  acceleration  and  pitch  rate  responses  of 
the  aircraft,  respectively. 

The  analytical  method  used  to  derive  the  longitudinal  axis  feedback  gains  for  eech  of  the  AFTI/F-16 
standard  modes  is  based  on  optimal  control  theory  and  is  referred  to  as  linear  quadratic  synthesis 
(LQS).  In  this  procedure,  weighting  parameters  in  a  quadratic  cost  function  are  selected  to  yield 
systems  with  desirable  performance  characteristics.  Weighting  parameters  reflect  consideration  of 
gust  response,  tracking  performance,  pahse  and  gain  margin,  short  period  frequency  and  damping, 
transient  response  characteristics  and  other  relevant  performance  indices.  Simplified  longitudinal 
and  lateral-directional  block  diagrams  of  the  Normal  Mode  flight  control  system  are  shown  in 
Figures  62  and  63,  respectively.  In  addition  to  the  feedback  gain  variables,  further  response  tailor¬ 
ing  is  provided  to  the  system  through  the  command  path  parameters,  pilot  gain  (Kp)  and  pilot  time 
constant  (1/a).  Optimum  L/D  flap  scheduling  is  also  provided. 

Most  of  the  inner  loop  gains  are  scheduled  with  air  data  derived  quantities  to  provide  good  response 
over  the  entire  flight  envelope.  In  addition,  some  filter  time  constants  and  break  frequencies  are 
also  scheduled.  Structural  limiting  is  also  provided  to  prevent  overstressing  the  airplane  during 
maneuvers.  One  of  several  wavs  this  is  done  is  by  limiting  flap  travel  as  function  of  air  data,  Mach, 
altitude,  and  load  factor. 
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Figure  60.  Pitch  DFCS'  Multimode  Control 
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Figure  61.  Lateral-Directional  DFCS  Multimode  Control 
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A  conventional  approach  to  directional  augmentation  was  selected  for  the  system  concept.  Lateral 
acceleration  feedback  provides  coordination;  washed-out  yaw-rate  feedback  enhances  dutch-roll 
damping,  and  an  aileron-rudder-interconnect  (ARI)  and  a  roll  rate-AOA  (pa)  interconnect  improves 
turn  coordination.  The  principle  alternative  to  this  design  philosophy  is  the  beta-dot  (sideslip  rate) 
feedback  concept  employed  in  the  decoupled  system.  The  beta-dot  signal  is  synthesized  using  non- 
redundant  Euler  attitude  and  velocity  data.  A  technique  has  been  developed  to  give  fail-operate 
performance  in  the  decoupled  control  mode  in  the  event  of  the  loss  of  these  data.  However,  higher 
reliability  is  desired  for  the  primary  takeoff -and-directional  control  system  so  a  separate,  more  con¬ 
ventional,  directional  control  system  has  been  developed  for  the  Standard  Normal  Mode.  In  sum¬ 
mary,  the  approach  that  was  taken  in  the  flight  control  system  design  of  the  Standard  Normal  Mode 
was  to  develop  a  system  that  produced  smooth,  uniform,  responsive  handling  qualities  and  provided 
gust  alleviation  of  normal  acceleration,  while  simultaneously  meeting  the  stability  and  root  location 
specification,  and  not  violating  any  physical  constraints.  Using  this  design  procedure,  gain  schedules 
were  established  over  a  suitable  range  of  flight  conditions. 

As  in  the  Normal  Mode,  certain  tradeoffs  arise  in  the  development  of  the  flight  control  laws  in  the 
Air  Combat  Mode.  However,  since  tracking  characteristics  and  aircraft  attitude  control  are  of  pri¬ 
mary  interest  in  this  mode,  a  different  set  of  performance  measures  are  emphasized  in  evaluating 
system  designs.  To  aid  in  achieving  the  desired  level  of  performance  in  the  mode,  additional  com¬ 
pensation  was  added  to  the  command  path  of  the  flight  control  system.  The  structure  of  this  com¬ 
pensation  is  depicted  in  Figure  64.  Because  of  task  similarities,  the  Air-to-Surface  gunnery  mode  is 
virtually  identical  to  the  Air-to-Air  gunnery  mode  in  the  pitch  axis.  It  should  be  noted  that  the 
gains  shown  in  the  block  diagram  will  also  have  values  different  than  in  the  Normal  Mode.  The 
methodology  described  above  was  also  used  in  developing  the  Air-to-Surface  bombing  mode  which 
emphasizes  precise  flight  path  control  and  is  illustrated  in  Figure  65. 

4.  Decoupled  Control  Modes  — 


The  decoupled  control  laws  provide  independent  control  of  all  six  degrees-of-freedom  of  motion. 
They  are  accessible  from  all  major  modes.  Certain  default  or  preselected  decoupled  motions  have 
been  defined  for  the  major  modes  but  can  be  overriden  by  pilot  input  through  the  MPD's.  AFT!/ 
F-16  decoupled  maneuvers  are  illustrated  in  Figures  66  thru  71  inclusive. 

The  control  laws  for  implementing  these  decoupled  modes  were  synthesized  using  classical  fixed- 
flight  condition  feedback  control  methods.  Within  this  classical  approach,  there  were  several  ways 
to  decouple  pitch  rotation  from  normal  acceleration.  One  such  way  is  to  analytically  derive  the 
precise  compensators,  as  a  function  of  aircraft  aerodynamic  parameters,  required  to  cancel  the  basic 
aircraft  dynamics  while  at  the  same  time  substituting  a  set  of  desired  dynamics  for  the  total  closed- 
loop  system.  Results  of  analysis  showed  that  responses  obtained  from  a  system  decoupled  in  this 
manner  were  unacceptably  sensitive  to  errors  in  the  designer's  knowledge  of  the  fundamental  air¬ 
craft  aerodynamic  parameters. 

Another  approach,  and  the  one  selected  for  implementation,  is  the  use  of  feedbacks  of  the  variables 
to  be  decoupled  to  produce  high-gained  error  signals  to  drive  the  control  surfaces.  This  approach 
does  not  rely  on  unreasonably  accurate  estimates  of  the  aerodynamic  parameters  to  accomplish  an 
acceptable  degree  of  decoupling.  When  the  Normal  or  Bombing  Modes  are  selected,  the  system  con¬ 
figuration  will  emphasize  flight-path  control  whereas  the  gunnery  modes  will  emphasize  attitude 
control.  An  important  consideration  in  the  final  selection  of  the  decoupled  variables  is  the  fact  that 
the  IFFC  algorithms  produce  normal  and  lateral  acceleration  commands  and  pitch  rate,  yaw  rate  and 
roll  rate  commands.  Thus,  An  and  q  and  Ay,  0,  and  p  were  selected  to  be  decoupled  for  the  longi¬ 
tudinal  and  lateral  modes,  respectively.  Coordinated  control-surface  limiting  (CCSL)  was  developed 


Figure  63.  Simplified  Lateral-Directional  Standard  Normal  Control  Mode  Block  Diagram. 
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as  a  means  to  accomplish  smooth  transient-free  control-surface  coordination  and  limiting.  Proper 
decoupled  mode  operation  is  always  dependent  on  balanced  forces  and  moments.  This  requirement 
dictates  that  when  a  control -surface  limit  occurs,  further  decoupling  inputs  to  other  control  surfaces 
must  be  inhibited  and  the  system  status  maintained  at  that  point  until  surface  limits  are  no  longer 
exceeded.  This  CCSL  concept  has  been  implemented,  as  required,  in  the  longitudinal  and  lateral 
axes  to  achieve  control -surface  limiting  while  retaining  the  maximum  available  decoupled  response. 
The  engagement  of  the  decoupled  modes  with  correct  initial  conditions  is  accomplished  in  an  initial¬ 
ization  routine  that  automatically  balances  the  system  with  the  existing  set  of  inputs  and  outputs. 

Tables  7  and  8  list  the  Longitudinal  and  the  Lateral-Direction  Control  Modes  respectively.  The 
controllers  and  control  surfaces  used  are  also  listed. 

Table  7 

AFTI/F-16  DFCS  DECOUPLED 
LONGITUDINAL  CONTROL  MODES 


•  Modes 

1.  An  —  Direct  Lift 

2.  oq  —  Fuselage  Pointing 

3.  (*2  —  Vertical  Translation 


•  Controller 

•  Twistable  Throttle  Grip 


•  Control  Surfaces 

•  Flaperons  Balanced  with  Horizontal  Tail 


Table  8 

AFTI/F-16  DFCS  DECOUPLED  LATERAL- 
Dl  RECTIONAL  CONTROL  MODES 


•  Modes 

1.  Ay  -  Direct  Sideforce 

2.  0i  —  Fuselage  Pointing 

3.  02  -  Lateral  Translation 

•  Controller 

•  Rudder  Pedals 

•  Control  Surfaces 

•  Vertical  Canards  Balanced  with  Rudder 


SIMPLIFIED  BLOCK  DIAGRAM 
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Figure  64.  Simplified  Air  Combat  Gunnery  Mode. 
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•  VERTICAL  FLIGHT  PATH  CONTROL 


•  USEFUL  FOR  PITCH  ATTITUDE 
CORRECTIONS 

•  MINIMUM  ALTITUDE  LOSS  DURING 
DIVE  RECOVERY 

•  MOST  IMPRESSIVE  OF  THE 
LONGITUDINAL  MODES 


•  CONSTANT  AOA 

•  3"g"  AUTHORITY 

•  INCREASED  "g"  CAPABILITY 


Figure  66.  Direct  Lift  (A|\j)  Control  Mode. 
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Figure  67.  Direct  Sideforce  (Ay)  Control  Mode. 


•  PITCH  ATTITUDE  CONTROL 

•  CONSTANT  FLIGHT  PATH 

•  3°  TO  4°  AUTHORITY 
(50-70  MILLI RADIANS) 


•  PREREQUISITE  FOR  INTEGRATED  FIRE /FLIGHT  CONTROL 

•  MORE  IMPRESSIVE  FROM  PILOTS  VIEW 


Figure  68.  Pitch  Pointing  (ck-j )  Control  Mode 
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•  DIRECTIONAL  ATTITUDE  CONTROL 

•  CONSTANT  FLIGHT  PATH 

•  NOSIDEFORCE 

•  5°  SIDESLIP  AVAILABLE 
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•  PREREQUISITE  TO  INTEGRATED  FIRE /FLIGHT  CONTROL 

•  MORE  IMPRESSIVE  FROM  PILOT'S  VIEW 


Figure  69.  Yaw  Pointing  )  Control  Mode. 


•  VERTICAL  VELOCITY  CONTROL 

•  CONSTANT  PITCH  ATTITUDE 


•  IDEAL  FOR  SMALL  VERTICAL 
POSITION  CHANGES  SUCH  AS 
FORMATION  FLYING  OR  FLIGHT 
PATH  ADJUSTMENTS 


Figure  70.  Vertical  Translation  (c^)  Control  Mode. 
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Figure  71.  Lateral  Translation  (f^)  Control  Mode. 
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Figure  72  thru  74  inclusive  illustrate  how  the  use  of  these  decoupled  modes  improve  the  operational 
capability  of  an  aircraft. 

a.  Longitudinal  Decoupling  - 

Since  normal  acceleration  and  pitch  rate  are  the  variables  to  be  decoupled,  these  sensed  quantities 
are  fed  back  as  shown  in  the  Air  Combat  mode  example  of  Figure  75.  The  sidestick  controller  pro¬ 
vides  direct  lift  commands  and  the  throttle  grip  provides  pointing  and  translation  commands.  A 
third  feedback  is  angle  of  attack.  Since  the  airframe  is  statically  unstable  over  most  of  the  subsonic 
flight  envelope,  a  combination  of  angle  of  attack  and  pitch  control  law  decouples  this  new  "pre¬ 
stabilized"  coupled  system.  Decoupling  relies  on  the  symmetrical  deflection  of  the  trailing-edge 
flaps  as  well  as  the  symmetrical  deflections  of  the  horizontal  tail.  An  important  limiting  feature  is 
the  angle-of-attack  limiting.  Pilot  command  limiting  is  also  provided.  The  design  also  includes  a 
flap  "washout"  function.  To  prevent  the  flap  from  achieving  steady-state  offset  from  its  optimum 
flap  schedule,  the  flap  command  is  fed  back  in  a  manner  which  tends  to  return  the  flap  to  the  flap 
position  prescribed  by  the  optimum  flap  schedule.  The  flap  remains  at  (or  returns  to)  the  position 
dictated  by  the  optimum  flap  schedule  during  relatively  quiescent  periods  of  controller  activity. 

Another  important  functional  element  of  the  system  is  the  surface  command  crossfeeds.  The  accel¬ 
eration  error,  which  becomes  ultimately  the  primary  flap  command,  is  also  scaled  by  a  different  value 
and  sent  to  the  horizontal  tail.  The  scale  factor  applied  is  theoretically  the  one  required  to  alter  the 
tail  position  by  the  amount  required  to  cancel  the  change  in  pitching  moment  due  to  the  new  flap 
position.  Conversely,  the  pitch-rate  error  is  crossfed  through  an  appropriate  scale  factor  to  the  flap 
to  cancel  the  change  in  normal  acceleration  created  by  the  new  tail  position.  The  crossfeed  of  nor¬ 
mal  acceleration  to  the  tail  is  an  influential  path,  because  even  though  the  flap  is  primarily  a  lift- 
producing  surface,  it  is  also  a  non-negligible  moment  producer.  On  the  other  hand,  the  pitch-rate 
error-to-flap  corssfeed  is  quite  insignificant  at  most  flight  conditions  because  tail  position  changes 
produce  relatively  small  lift  changes. 

b.  Lateral-Directional  Decoupling 

To  generate  lateral-directional  decoupled  motions,  the  control  system  must  be  able  to  constrain  the 
value  of  any  two  of  the  three  directional  states  (sideforce,  sideslip,  heading)  in  addition  to  minimiz¬ 
ing  roll  rate.  In  order  to  achieve  this  capability  three  basic  design  concepts  are  employed.  The  Air- 
to  Surface  bombing  flat  turn  mode  of  Figure  76  is  an  example,  (a)  A  dedicated  feedback  loop  is 
designed  for  each  lateral-direction  state  to  be  controlled.  Roll  rate  is  fed  back  to  the  aileron  controls; 
beta-dot  is  fed  back  to  the  rudder,  and  sideforce  is  fed  back  to  the  canards,  (b)  In  each  of  the  con¬ 
trol  loops,  a  proportional-plus-integral  network  is  engaged  to  force  steady  state  command  errors  to 
zero,  (c)  The  underlying  mathematical  theory  of  the  decoupling  concept  assumes  that  the  com¬ 
mands  from  the  dedicated  control  loops  can  produce  pure  forces  or  moments.  For  example,  the 
roll  loop  command  to  the  ailerons  (flaperons)  would  produce  a  rolling  moment  without  attendant 
yawing  moment  or  sideforce.  Similarly,  the  force-loop  command  would  produce  surface  deflections 
do  produce  sideforce,  rolling  moment,  and  yawing  moments,  interconnect  command  signals  are 
generated  in  order  to  cancel  the  undesirable  effects.  In  theory,  a  total  of  1 1  interconnect  signals 
of  this  sort  would  be  required  to  cancel  the  cross-coupling  between  system  states.  However,  all  but 
four  of  these  signals  can  be  neglected  and  satisfactory  decoupling  performance  of  the  Standard 
Normal  system;  the  roll-rate-error  integrator  is  engaged  either  during  gunfiring  operations  or  when 
a  directional  command  is  input  via  the  pedals.  There  are  also  two  decoupling  signals  added  to  the 
aileron  command.  One  signal  is  the  canard-to-aileron  interconnect;  the  other  cancels  the  rolling 
moment  induced  by  the  sideslip  which  is  generated  during  pointing  or  translational  maneuvers. 
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VERY  EFFECTIVE  FOR  SMALL  HEADING  CORRECTIONS  IN  AIR-TO-GROUND  SEGMENTS. 
THE  USE  OF  RUDDER  PEDALS  PROVIDED  A  NATURAL  MEANS  FOR  FLAT  TURN  CONTROL. 


Figure  74.  Effect  of  Fuselage  Aiming  On  Air-to-Air  Combat 


SIMPLIFIED  BLOCK  DIAGRAM 


Figure  75.  Air  Combat  Pitch  Pointing  Mode. 


SIMPLIFIED  BLOCK  DIAGRAM 


Figure  76.  Air-to-Surface  Flat  Turn  Bombing  Mode. 
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The  most  important  differences  between  the  Standard  Normal  and  Decoupled  systems  for  lateral- 
directional  augmentation  is  the  choice  of  feedback  states  used  to  control  yawing  moments.  The 
decoupled  system  used  a  synthesized  beta-dot  feedback  for  the  following  reasons:  (a)  Beta-dot  is 
a  key  quantity  that  must  be  precisely  regulated  to  maintain  decoupling  purity,  and  its  direct  use  as 
a  feedback  will  maximize  the  degree  of  control  over  it.  (b)  Better  dutch-roll  damping  can  be  ob¬ 
tained  from  a  beta-dot  system  in  spite  of  the  special  decoupling  interconnects  that  are  required  and 
tend  to  destabilize  the  system.  This  consideration  is  much  more  important  because  directional 
motions  will  be  intentionally  induced  as  a  control  mechanism  during  precision  tracking  tasks,  (c) 
Better  turn  coordination  can  be  obtained  from  the  beta-dot  system,  (d)  The  beta-dot  system  pro¬ 
vides  a  natural  inner  loop  for  an  IFFC  system.  A  maximum  of  2  g's  can  be  commanded  in  the 
direct  sideforce  maneuver.  However,  at  most  flight  conditions  the  canard  effectiveness  or  struc¬ 
tural  limits  are  not  adequate  to  generate  that  amount  of  force  while  sideslip  is  being  constrained  to 
zero.  Consequently,  when  the  canards  do  saturate  and  the  recoupling  option  has  been  selected,  the 
canard-to-rudder  decoupling  signal  is  reduced  to  allow  sideslip  to  develop.  In  most  cases,  this  side¬ 
slip  will  generate  enough  additional  sideforce  to  satisfy  the  pilot  command. 

The  descriptions  of  the  advanced  flight  control  modes  of  the  AFTI/F-16  were  obtained  from  Ref¬ 
erence  1 1 . 
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THE  ADVANCED  FLIGHT  CONTROL  ACTUATION  SYSTEM  (AFCAS)  PROGRAM 


The  development  of  Advanced  Flight  Control  Actuation  Systems  (AFCAS)  for  next  generation  air¬ 
craft  has  been  a  joint  undertaking  by  the  Navy  and  the  Rockwell  International  Corporation  since 
1972.  The  sixth  and  final  phase  of  the  program  was  completed  in  November  1979. 

The  complexity  of  flight  control  systems  has  increased  until  present  initial  costs  and  required 
maintenance  time  are  approaching  prohibitive  levels.  This  situation  is  due  primarily  to  the  design 
philosophy  that  improvements  and  refinements  are  best  achieved  by  adding  on  accessories  and/or 
components  to  proven,  traditional  systems.  Broad  new  approaches  and  technologies  involving  ad¬ 
vances  in  power  generation,  transmission,  control,  and  actuation  will  be  required  to  alleviate  com¬ 
plexity  in  future  Navy  aircraft  The  AFCAS  Program  is  a  significant  step  in  this  direction. 

Phase  I  of  the  AFCAS  Program  established  that  a  direct-drive  flow  control  valve,  modular  con¬ 
figured  actuator,  and  a  localized  power  package  could  be  readily  integrated  into  a  computer¬ 
operated,  fly-by-wire  system.  Adoption  of  AFCAS  concepts  should  enhance  flight  control  system 
maintainability,  reliability,  combat  survivability,  and  lower  initial  costs.  Reference  12. 

Efforts  to  confirm  the  practicality  of  Phase  I  concepts  were  begun  in  Phase  II  with  the  design  and 
fabrication  of  an  engineering  model,  8000  psi  (55  MPa),  control-by-wire,  modular  configured 
aircraft-type  hydraulic  servo  actuator.  Reference  13.  Electrical  inputs  were  applied  to  force  (torque) 
motors  employing  cobalt  samarium  permanent  magnets.  Motor  output  was  connected  directly  to 
single  stage  spool/sleeve  type  flow  control  valves.  The  force  motors  and  flow  control  valves  could 
be  integrated  into  dual  tandem,  dual  parallel,  or  single  actuator  configurations. 

Phase  III  involved  conducting  laboratory  performance  tests  on  the  engineering  model  actuator(s) 
built  in  Phase  II,  Reference  14.  Static  and  dynamic  tests  were  conducted  on  the  force  motors,  motor/ 
valve  subassemblies,  electronic  drive  unit,  and  actuator  assemblies  including  dual  system  tandem, 
dual  system  parallel,  and  single  system  configurations.  The  dual  tandem  actuator  was  tested  under 
load.  Major  achievements  accomplished  in  Phase  III  were: 

•  Successful  operation  of  a  direct  electrical  control  "muscle"  actuator  for  primary  flight  control 
surfaces. 

•  Use  of  building-block  elements  to  assemble  dual  tandem,  dual  parallel,  and  single  actuator 
configurations. 

•  Successful  operation  of  a  control-by-wire  hydraulic  actuator,  utilizing  8000  psi  (55  MPa) 
operating  pressure. 

•  Successful  performance  of  a  laboratory-type  electronic  drive  unit  which  provided  high  immun¬ 
ity  to  circuitry  failures. 

In  Phase  IV,  an  8000  psi  (55  MPa)  control-by-wire,  modular  rudder  actuator  was  designed  and  fab¬ 
ricated  for  future  flight  testing  on  a  T-2C  airplane,  Reference  15.  Actuator  design  criteria  were  based 
on  T-2C  aerodynamic  considerations,  envelope  constraints,  and  single  system  hydraulics.  Actuator 
output  was  commanded  by  a  single  stage  spool/sleeve  valve  driven  directly  by  a  permanent  magnet 
force  motor.  The  force  motor  was  powered  by  an  electronic  drive  unit  which  received  inputs  from  a 
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force  transducer  in  the  rudder  system  and  position  transducers  on  the  actuator.  A  localized  hydrau¬ 
lic  power  unit  supplied  8000  psi  (55  MPa)  pressure  for  the  rudder  actuator. 

In  Phase  V,  a  direct-drive  control-by-wire  muscle  actuator,  powered  by  a  localized  8000  psi  (55  MPa) 
hydraulic  system,  was  used  to  control  the  directional  flight  of  a  T-2C,  Reference  16.  Successful  op¬ 
eration  of  the  test  installation  represented  a  significant  milestone  in  the  development  of  advanced 
flight  controls.  No  problems  were  encountered;  the  system  functioned  exceptionally  well  and  pilot 
response  was  favorable.  The  test  results  confirmed  analyses  and  laboratory  investigations  reported 
in  References  12  through  15.  The  ease  with  which  flight  testing  was  accomplished  verified  that 
AFCAS-type  systems  can  be  designed,  fabricated  and  maintained  without  special  techniques  or 
state-of-the-art  advances. 

In  Phase  VI  the  feasibility  of  Direct  Digital  Drive  (D^)  for  an  AFCAS  was  successfully  flight  tested 
in  theT-2C  aircraft.  Reference  16.  The  test  installation  contained  a  digitally  controlled  direct  drive 
rudder  actuator,  microcomputer,  electronic  drive  unit,  force  transducers,  and  a  localized  8000  psi 
(55  MPa)  hydraulic  power  supply.  The  system  met  all  laboratory  and  flight  test  objectives  and 
demonstrated  direct  microcomputer  control  of  primary  flight  control  surfaces.  Phase  VI  demon¬ 
strated  an  approach  that  will  improve  performance  and  reliability  of  FBW  control  systems  by  reduc¬ 
ing  system  complexity. 

DESIGN  PHI  LOSOPHY  OF  THE  AFCAS  CONCEPT 

Flight  control  systems  need  to  be  as  simple,  direct  and  foolproof  as  possible  with  regard  to  design, 
operation,  inspection  and  maintenance.  This  requirement,  as  defined  by  MIL-F-18372,  continues 
to  be  an  excellent  basis  for  the  design  philosophy  of  primary  controls  and  needs  to  be  stressed  in 
evolving  fly-by-wire  (FBW)  systems.  Basically  there  are  two  ways  of  achieving  the  level  of  reliability 
required  for  fully  powered  primary  flight  controls.  The  first  is  to  develop  highly  reliable  parts  for 
use  in  the  systems.  The  second  is  to  design  reliable  systems  utilizing  redundancy  techniques.  Neither 
approach  leads  to  an  acceptable  solution  of  the  immediate  problem.  Development  and  verification 
of  components  having  the  necessary  reliability  is  a  long  term  project  while  indiscriminant  system 
redundancy  leads  to  impractical  complexity  and  unwieldy  packages.  A  judicious  blend  of  the  two 
approaches  is  necessary  to  effect  an  acceptable  near-term  system  design. 

The  first  step  of  fundamental  importance  in  achieving  high  reliability  in  FBW  control  systems  is 
minimizing  the  number  of  component  parts.  Pursuing  this  approach  leads  to  a  simplified  FBW  sys¬ 
tem  utilizing  dualized  hydraulic  power  systems.  To  achieve  reliability  equal  to  or  exceeding  that 
of  its  dual  mechanical  counterpart,  the  approach  should  follow  the  design  philosophies  used  in  con¬ 
ventional  mechanical  systems.  They  are: 

•  Failures  are  never  abrupt  but  are  progressive  over  periods  of  extended  use. 

•  System  failures  do  not  result  in  hardovers. 

•  The  existance  of  failures  does  not  degrade  total  system  operation. 

•  Design  margins  are  in  excess  of  normally  used  values. 

•  Design  to  minimize  maintenance  actions  precludes  "Murphy  Failures"  or  human  errors. 

•  Success  of  the  system  is  attributed  to  subsystem  elements  with  high  designed-in  reliability 
obtained  with  redundant  configurations. 

Fundamentally,  design  of  FBW  electronic  circuits  should  center  about  the  foregoing  philosophy  us¬ 
ing  feedback  and  redundant  techniques.  Present  availability  of  small  low  cost  electronic  devices, 


NADC-82240-60 


integrated  circuits,  (1C  or  LIC)  permits  consideration  of  this  approach.  Each  function  circuit  would 
contain  several  paths  for  independent  operation  similar  to  the  present  cable  system.  The  goal  is  a 
FBW  system  where  the  time  between  required  maintenance  actions  approaches  the  aircraft  overhaul 
period. 

DESCRIPTION  OF  THE  AFCAS  CONCEPT 

The  AFCAS  concept  employs  control  of  the  primary  surface  actuators  directly  by  an  onboard  digi¬ 
tal  computer  or  by  a  standby  processor.  Command  signals  are  applied  directly  to  the  single  stage 
control  valve.  Direct  control  of  the  surface  actuator  eliminates  augmentation  actuators.  Actuator 
power  is  provided  by  8,000  psi  localized  electrically  or  mechanically  driven  hydraulic  packages  in 
lieu  of  a  centralized  hydraulic  system.  Flexible  building  block  components  provides  single  or  dual 
system  surface  actuators  having  the  desired  simplicity  and  hardware  commonality  for  standard  act¬ 
uator  classification.  A  direct  drive  single  stage  servo  valve  is  utilized  which  eliminates  contaminant 
sensitive  small  nozzles,  flappers  and  jet-pipes.  The  aim  is  to  provide  simple,  rugged,  reliable  compo¬ 
nents  which  can  be  integrated  with  an  advanced  digital  flight  computer  into  a  complete  FBW  system 
for  future  advanced  aircraft. 

The  control  valve  employs  a  highly  reliable  single  stage  design  combining  high  performance  with 
simplicity  and  ruggedness.  A  single  moving  part  consisting  of  a  spring  centered,  Away  spool  is  driven 
by  a  high  output  torque  motor.  The  basic  valve  is  compatible  with  single  and  dual  actuators.  Re¬ 
placement  of  the  conventional  two-stage  hydraulic  servo  valve  (8  ma  control  current)  with  a  high 
force  single-stage  concept  results  in  a  significant  improvement  in  reliability  because  small  moving 
parts  that  are  susceptible  to  minute  fluid  contamination  are  eliminated,  and  the  fragile  fine  wire 
wound  torque  motor  is  replaced  with  a  large  ruggedized  magnetic  coil. 

The  evolution  of  solid-stage  power  amplifiers  has  resulted  in  devices,  such  as  silicon  controlled  rec¬ 
tifiers  and  switches,  that  can  now  effectively  and  reliably  handle  the  power  required  in  going  from 
low  power  control  signals  to  the  relatively  high  power  level  necessary  for  single  stage  valves. 

This  approach  is  centered  on  the  elimination  of  the  hardover  potential  by: 

•  Developing  sufficient  force  on  the  val  <?  spool  to  insure  shear-out  of  all  contaminants. 

•  Design  of  the  valve  torque  motor  coils  such  that  an  open  or  short  will  not  cause  a  hardover. 

•  Design  of  torque  motor  drive  circuitry  which  precludes  hardover  conditions  due  to  component 
failures. 

•  Redundant  feedback  connections  to  preclude  hardovers  due  to  an  open  transducer. 

The  AFCAS  configuration  consists  of  a  j.  roportional  control  loop  utilizing  a  Away  spool  and  sleeve 
valve  driven  by  a  high  output  torque  motor.  The  spool  has  two  lands  and  is  flow  force  compensated. 
Spool  travel  is  0.010  inches  to  insure  null  tracking  over  the  entire  operating  temperature  range.  Flow 
forces  are  below  one  pound.  The  torque  motor  produces  at  least  40  pounds  drive  force  on  the  spool 
at  null  position.  The  torque  motor  is  kept  dry  to  eliminate  accumulation  of  contamination  at  the 
permanent  magnet.  The  spool  centering  springs  have  a  sufficiently  high  rate  to  insure  positive 
centering  at  electrical  zero  and  to  provide  sufficiently  high  frequency  response.  The  valve  housing 
is  compatible  with  modular  dual  actuators  utilizing  rip-stop  design  principles.  The  dual  spools  have 
provision  for  rigid  mechanical  synchronization.  The  entire  valve,  including  housing  is  made  of 
steel.  The  valve  assembly  weighs  less  than  5  pounds.  Figure  77  shows  the  salient  features  of  the 
direct  drive  control  valve  package. 
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SERVO  VALVE  DESIGN  REQUIREMENTS 

The  following  general  servo  valve  requirements  were  established  during  Phase  I  of  the  program  to 
facilitate  evaluation  of  the  various  options  available  and  to  provide  a  common  basis  for  comparison. 
The  requirements  were  kept  as  general  and  loose  as  possible  to  prevent  unnecessary  constraints. 

•  Single  Stage 

The  valves  shall  incorporate  only  one  hydraulic  stage.  TL.s  is  a  basic  goal  of  the  proposed 
approach.  The  aim  is  to  eliminate  Small  orifices  and  passageways  which  can  clog  and  produce 
hard  over  failures. 

•  8,000  PSI 

The  system  operating  pressure  shall  be  8,000  psi.  VHP  study  effort  to  date  indicates  future 
aircraft  should  utilize  high  pressures  to  effect  considerable  savings  in  weight  and  space  of 
hydraulic  system  components. 

•  Dual  Tandem 

The  valve  design  must  be  compatible  with  dual  tandem  actuators.  The  proposed  actuation 
system  approach  consists  of  two  channels,  and  two  hydraulic  power  output  elements  con¬ 
trolled  by  two  electrical  commands  driving  two  valves  connected  in  dual  tandem. 

•  Shock 

The  valve  shall  be  inherently  rugged  and  able  to  withstand  1,000  g's  shock  in  any  axis. 

•  Weight 

The  weight  goal  for  the  entire  valve  assembly  shall  be  less  than  5  pounds.  This  represents  a 
reduction  of  about  1  pound  when  compared  to  typical  mechanical  input  surface  actuator 
valves. 

•  Flow 


The  basic  design  shall  provide  flow  rates  up  to  15  gpm  by  resizing  orifice  area  gradients  and/or 
flow  compensation.  The  goal  is  to  standardize  valve  parts.  All  classes  of  valves  will  be  assem¬ 
bled  using  common  housings,  torque  motors,  mountings,  etc.  Adjustable  mechanical  stops 
shall  be  utilized  to  reduce  the  number  of  spool-sleeve  designs  to  a  minimum. 

•  Null  Leakage 

Null  leakage  shall  be  less  than  0.5%  of  rated  flow  at  8,000  psi.  This  level  is  selected  as  a  com¬ 
promise  between  power  loss,  overlap,  and  manufacturing  tolerances. 

•  Natural  Frequency 


The  natural  frequency  shall  be  at  least  35  Hertz.  This  value  places  the  valve  at  least  one  order 
of  magnitude  beyond  the  actuator  loop  frequency  thereby  assuring  minimal  influence  and 
ease  of  loop  design. 
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•  Hysteresis 

The  hysteresis  shall  not  exceed  4  percent  of  the  rated  input  signal. 

•  Dead  Zone 

Dead  zone  in  the  flow  vs.  input  current  characteristic  curve  shall  be  less  than  4%. 

•  Valve  Stroke 

The  spool  stroke  shall  be  0.040  inch. 

•  Life 

The  valve  shall  withstand  4,500,000  cycles  at  rated  pressure  and  2%  of  rated  flow,  and  500,000 
cycles  at  100%  rated  flow. 

•  Spool  Drive  Force 

The  electromechanical  transducer  shall  provide  at  least  40  pounds  spool  drive  force  at  null. 

This  requirement  is  a  compromise  between  sufficient  force  to  shear  out  material  or  contamina¬ 
tion  which  could  enter  an  orifice  and  reasonable  size  transducers. 

•  Linearity 

The  flow  vs.  current  plot  shall  be  linear  within  15%  of  rated  input  current. 

•  Null  Shift 


The  change  in  the  null  point  shall  not  vary  more  than  5%  throughout  the  operating 
environment 

AFCAS  CONFIGURATIONS  TESTED 

Three  types  of  actuation  configurations  were  fabricated,  assembled  and  tested  during  the  third  phase 
of  the  AFCAS  program  (reference  14)  and  are  listed  as  follows: 

( 1 )  Single  System  Actuator  { Figure  78) 

(2)  Dual  System  Parallel  Actuator  (Figure  79) 

(3)  Dual  System  Tandem  Actuator  ( Figure  80) 

The  "building  block"  concept  developed  in  Reference  12  was  used  as  a  basis  for  the  design  of  mod¬ 
ular  elements  which  can  be  assembled  to  form  any  of  the  three  actuation  configurations  listed 
above.  The  two  dual  configurations  are  controlled  by  two  mechanically  synchronized  Direct  Drive 
Control  Valve  Assemblies.  During  the  laboratory  tests  of  the  three  actuator  configurations,  an 
electronic  interface  unit  supplied  the  power  required  to  drive  the  force  motors.  Independent 
current-drive  circuits  for  each  of  the  four  windings  in  each  motor  were  provided  for  redundancy. 
Figure  81  is  a  photograph  of  a  force  motor.  Figure  82  shows  the  interface  between  the  Electronic 
Interface  Unit  and  a  dualized  Control-By-Wire  Actuator. 
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Figure  80.  Dual  System  Tandem  Actuator 
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e  82.  Block  Diagram  of  Electronic  Interface  Unit  and  Dualized  Control-by-Wire  Actuator 
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The  laboratory  performance  tests  conducted  during  Phase  III  were  successful  and  the  major  accom¬ 
plishments  achieved  during  this  program  phase  are  listed  as  follows: 

•  Successful  operation  of  a  direct  electrical  control  muscle  actuator  for  primary  flight  control 
surfaces. 

•  Use  of  building-block  elements  to  assemble  dual  tandem,  dual  parallel,  and  single  actuator 
configurations. 

•  Successful  operation  of  a  control-by-wire  hydraulic  actuator  utilizing  8,000  psi  (55  MPa) 
operating  pressure. 

•  Successful  performance  of  a  laboratory-type  electronic  drive  unit  which  provided  high  immun¬ 
ity  to  circuitry  failures. 

FLIGHT  VERIFICATION  OF  THE  AFCAS  CONCEPT  IN  THE  T-2C  AIRCRAFT 

In  Phase  IV,  an  8,000  psi  (55  MPa)  control-by-wire,  modular  rudder  actuator  was  designed  and  fab¬ 
ricated  for  future  flight  testing  on  a  T-2C  airplane,  Reference  15.  Actuator  design  criteria  were 
based  on  T-2C  aerodynamic  considerations,  envelope  constraints,  and  single  system  hydraulics. 
Actuator  output  was  commanded  by  a  single  stage  spool/sleeve  valve  driven  directly  by  a  permanent 
magnet  force  motor.  The  force  motor  was  to  be  powered  by  an  electronic  drive  unit  which  received 
inputs  from  a  force  transducer  in  the  rudder  system  and  position  transducers  on  the  actuator.  A 
localized  hydraulic  power  unit  was  planned  to  supply  8,000  psi  (55  MPa)  pressure  for  the  rudder 
actuator. 

Figure  83  is  a  photograph  of  the  Rudder  Actuator  Assembly  designed  and  fabricated  during  Phase  IV 
and  used  in  the  flight  testing  of  the  AFCAS  concept  during  Phase  V. 

The  objective  of  Phase  V  was  to  design,  fabricate,  and  test  a  subsystem  to  verify  the  feasibility  of  the 
AFCAS  concept  in  the  flight  environment  The  test  system  was  installed  and  flown  in  a  T-2C  twin 
engine  turbojet  trainer  shown  in  Figure  84. 

1.  Technical  Approach 

The  directional  control  system  in  a  T-2C  airplane  was  changed  to  a  full-powered  control-by-wire  test 
installation  containing: 

•  Hydraulic  rudder  actuator 

•  Electronic  drive  unit 

•  Localized  hydraulic  power  unit 

•  Force  transducer 

The  existing  hydraulic  system  was  altered  to  operate  at  two  pressure  levels:  3,000  psi  (21  MPa)  and 
8,000  psi  (55  MPa).  Engine  driven  pumps  powered  the  3,000  psi  system  in  the  usual  manner.  A 
localized  motor/pump  unit  was  added  to  power  the  rudder  system  which  was  formerly  operated 
manually  by  the  pilot.  The  original  3,000  psi  and  newly  added  8,000  psi  systems  shared  the  existing 
reservoir  and  return  lines.  The  T-2C  electrical  system  was  altered  to  power  the  localized  motor/pump 
unit  and  electronic  drive  unit.  The  modified  system  functioned  the  same  as  the  basic  T-2C  system 
except  the  rudder  was  hydraulically  powered  instead  of  manually  operated. 

The  original  cable  system  between  the  rudder  pedals  and  rudder  was  changed  to  incorporate  the 
control-by-wire  test  installation.  The  rudder  pedal  cables  were  attached  to  a  sector  which  was  pre¬ 
vented  from  rotating  by  a  force  transducer.  Force  on  the  pedals  was  converted  to  a  proportional 


Figure  84.  T-2C  Demonstrator  Aircraft 


NADC-82240-60 


electric  voltage  from  the  transducer.  This  command  signal  was  conditioned  by  an  electronic  drive 
unit  which  powered  a  torque  motor  on  the  rudder  actuator.  The  torque  motor  in  turn  operated  a 
single  stage  flow  control  valve  on  the  actuator. 

The  direct-drive,  8,000  psi  rudder  actuator  designed  and  fabricated  in  Phase  IV  was  modified  to  in¬ 
corporate  a  bypass  valve.  This  device  allowed  the  rudder  to  seek  the  trail  position  if  system  pres¬ 
sure  were  lost  In  the  event  of  a  "hard-over"  type  electronic  failure,  the  pilot  could  permit  the  rud¬ 
der  to  trail  by  turning  the  8,000  psi  motor/pump  unit  "off." 

The  electronic  drive  unit  was  designed,  fabricated,  and  packaged  to  be  a  flightworthy  assembly.  The 
unit  had  dual  channels  with  sub-circuits  which  were  dualized.  The  circuitry  was  designed  with  re¬ 
dundancy  features  which  provided  high  immunity  to  component  failures. 

Requirements  were  established  for  an  8,000  psi  localized  hydraulic  power  supply.  The  pump  used 
was  the  same  unit  employed  for  flight  testing  in  the  Lightweight  Hydraulic  System  ( LHS)  develop¬ 
ment  program  except  delivery  was  reduced  to  match  rudder  actuator  flow  rates  and  to  lower  input 
power  requirements.  The  pump  was  mated  to  an  off-the-shelf,  aircraft  type  28  volt  DC  motor. 

The  force  transducer  incorporated  in  the  test  system  was  designed  specifically  for  this  application. 
The  transducer  utilized  two  linear  variable  differential  transformers  mounted  in  series. 

All  major  components  in  the  test  installation  were  assembled  in  the  laboratory  for  integration  test¬ 
ing.  Investigations  were  made  to  determine  if  detrimental  pressure  oscillations  or  surges  were  present 
Motor  current  and  system  heat  rejection  were  measured.  Frequency  response  tests  were  conducted 
on  the  actuator/system.  Nine  hours  of  simulated  flight  testing  were  performed  to  evaluate  the  en¬ 
durance  capability  of  system  components. 

The  test  system  was  installed  in  a  bailed  T-2C  with  instrumentation  for  monitoring  pressures,  flows, 
temperatures,  etc.  Standard  parameters  such  as  air  speed,  altitude,  engine  RPM,  etc.,  were  also  in¬ 
strumented.  Flight  data  were  collected  by  photorecorder  and  telemetry  systems. 

Procedures  were  established  for  system  checkout,  ground  demonstration,  and  flight  testing.  Approx¬ 
imately  ten  hours  of  flight  time  were  logged  on  the  test  system  at  various  altitudes  and  airspeeds. 

Pilot  observations  and  instrumentation  data  were  used  as  a  basis  for  evaluating  the  AFCAS 
installation. 

2.  T-2C  Airplane 

The  T-2C  "Buckeye"  is  built  by  the  Columbus  Aircraft  Division  of  Rockwell  International  Corpora¬ 
tion.  The  Buckeye  is  a  two-place,  subsonic  trainer  powered  by  twin  turbojet  engines.  The  aircraft 
is  designed  for  both  land  and  carrier  based  operations.  Distinguishing  features  include  wide- track 
tricycle  landing  gear,  straight  tapered  wings,  and  low  slung  intake  ducts. 

The  T-2C  is  used  as  a  basic  trainer  for  military  pilots,  and  is  equipped  for  cross-country  flight,  night 
flying,  and  low  altitude,  high  speed  navigation  exercises.  Maximum  level  flight  speed  of  the  Buckeye 
is  465  knots  (239  m/s)  at  15,000  feet  '4.6  km);  the  service  ceiling  is  45,000  feet  (13.7  km).  Take¬ 
off  and  landing  speeds  are  in  the  range  of  95  to  110  knots  (49  to  57  m/s).  A  typical  take-off  gross 
weight  is  13,000  pounds  (5,900  kg). 


Dual  power  sources  are  provided  for  the  electrical,  hydraulic,  and  air  conditioning  systems.  The 
flight  control  system  includes  hydraulic  full-powered  ailerons,  a  boosted  elevator,  and  an  electric 
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trim  system;  rudder  operation  is  manual.  The  aileron  and  elevator  actuators  are  part  of  mechanical 
linkage  connecting  the  pilot's  stick  to  the  control  surfaces.  Thus,  in  the  event  of  a  hydraulic  system 
malfunction,  control  of  the  aircraft  can  be  accomplished  manually. 

The  T-2C  has  a  3,000  psi  (21  MPa),  Type  II  (-65  to  +275°F)  (-54  to  +135°C)  single  hydraulic  sys¬ 
tem.  Two  pumps,  one  on  each  engine,  provide  power  to  operate  the  landing  gear,  speed  brakes, 
arresting  hook,  aileron  actuator,  and  elevator  boost  package.  The  pumps  are  constant  pressure, 
variable  delivery,  axial  piston  designs.  Each  pump  is  capable  of  delivering  4.9  gpm  (18.5  L/m)  at 

7.800  rpm.  Hydraulic  fluid  (Ml  L-H-5606)  is  supplied  to  the  pumps  by  an  air/oil  type  reservoir 
pressurized  by  engine  bleed  air.  Fluid  cleanliness  is  maintained  by  5  micron  absolute  filters. 

One  pump  can  adequately  handle  all  flow  demands.  However,  if  supply  pressure  should  drop  below 

1.800  psi  (12  MPa),  a  priority  valve  is  used  to  insure  operation  of  the  aileron  and  elevator  actuators. 
A  cockpit  controlled  shutoff  valve  is  installed  in  the  aileron/elevator  subsystem  to  permit  simulat¬ 
ing  loss  of  power  for  training  purposes.  The  landing  gear  and  arresting  hook  can  be  lowered  and 
locked  by  gravity,  if  desired.  The  wheel  brakes  have  an  independent  hydraulic  system. 

Electrical  power  is  supplied  by  two  28  volt  DC  300  ampere  starter-generators,  one  mounted  on  each 
engine.  The  generators  are  connected  for  parallel  operation  and  power  the  primary  bus.  Output 
voltages  are  regulated  for  varying  loads  and  engine  speeds. 

Two  nickel-cadmium  24  volt  re-chargeable  batteries  are  used  for  engine  starting  and  emergency  DC 
power.  The  batteries  are  normally  connected  in  parallel,  but  are  used  in  series  for  engine  starting. 

A  portion  of  the  28  volt  DC  power  is  converted  to  1 1 5  volt  400  Hz  AC  power  by  two  rotary  in¬ 
verters.  Inverter  No.  1  produces  500  volt-amperes  for  instruments;  inverter  No.  2  generates  1,500 
volt-amperes  for  avionics  and  serves  as  a  backup  source  for  instrument  power. 

3.  AFCAS  Flight  Test  Installation 

The  directional  (rudder)  system  in  a  bailed  T-2C  (BuNo.  152382)  was  changed  from  a  manual  to  a 
full-powered  control-by-wire  system  for  the  AFCAS  program.  Principal  components  in  the  test  in¬ 
stallation  were: 

•  Hydraulic  rudder  actuator 

•  Electronic  drive  unit 

•  Localized  hydraulic  power  unit 

•  Force  transducer 

Modifications  required  in  the  T-2C  to  accommodate  the  new  installation  are  discussed  in  the  follow¬ 
ing  sections  under  four  general  headings:  mechanical  system,  hydraulic  system,  electrical  system, 
and  instrumentation. 

a.  Mechanical  System 

Elements  of  the  mechanical  system  are  depicted  schematically  on  Figure  85.  The  salient  mechanical 
components  of  the  T-2C  rudder  control  system  are  listed  as  follows: 

•  Sector  assembly 

•  Sector  support 


SECTOR 

(Restrained  from  rotating  by  force  transducer) 
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Figure  85.  Schematic  Diagram  of  Mechanical  System 
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•  Bellcrar.k  assembly 

•  Rudder  actuator  mounting  bracket 

•  Force  transducer  mounting  braket 

The  T-2C  rudder  has  a  travel  of  ±25°.  For  safety  reasons,  rudder  travel  was  reduced  to  ±12°  in  the 
test  installation  by  limiting  actuator  stroke.  This  permits  the  pilot  to  land  safely  with  a  'hard-over" 
rudder,  opposite  engine  out,  and  three  knot  cross-wind. 

The  relationship  between  pedal  force  and  rudder  travel  is  approximately  7.5  Ib/deg  (33.3  N/deg)  of 
rudder  movement  or  90  lb  (0.4  kN)  for  full  travel  (12°).  Pedal  displacement  was  small,  approxi¬ 
mately  0.50  in.  (13mm),  since  the  force  transducer  length  changed  only  0.025  in.  (0.63mm)  for  full 
rudder  travel  (pedal  displacement  was  due  primarily  to  cable  stretch).  In  the  original  manual  control 
system,  pedal  displacement  was  approximately  4  in.  (10.2  cm)  for  full  rudder  travel  (25°). 

The  maximum  hinge  moment  normally  applied  to  the  T-2C  rudder  is  based  on  pilot  strength  and  is 
2,200  lb-in  (249  N-m).  Maximum  rudder  deflection  a  pilot  can  achieve  thus  depends  on  air  loads 
present.  The  AFCAS  rudder  actuator  can  develop  13,000  lb-in  (1,470  N-m).  Because  of  the  limited 
rudder  deflection  (12°  max.)  the  high  moment  capability  of  the  rudder  actuator  required  only  minor 
adjustment  in  the  T-2C  flight  envelope  to  assure  safety. 

b.  Hydraulic  System 

The  original  and  modified  hydraulic  systems  are  compared  schematically  on  Figure  86.  Major 
changes  required  in  theT-2C  hydraulic  system  to  accommodate  the  test  installation  were: 

•  Addition  of  an  electric  motor  driven  8,000  psi  (55  MPa)  variable  delivery  pump 

•  Addition  of  an  8,000  psi  control-by-wire  rudder  actuator  and  bypass  valve 

•  Addition  of  a  suction  line  from  the  reservoir  to  the  8,000  psi  pump,  pressure  line  from  the 
pump  to  the  rudder  actuator,  and  actuator  return  line 

•  Addition  of  pump  case  drain  return  and  shaft  seal  overboard  lines 

•  Relief  valve  installed  in  the  8,000  psi  system 

•  Heat  exchanger  installed  in  the  8,000  psi  pump  case  drain  line 

The  modified  system  is  shown  schematically  on  Figure  87.  The  3,000  psi  (21  MPa)  and  8,000  psi 
(55  MPa)  systems  shared  a  common  reservoir  and  common  return  lines.  All  major  components, 
except  for  the  rudder  actuator,  were  located  in  the  fuselage  compartment  above  the  engines. 

c.  Electrical  System 

The  electronic  drive  unit  was  designed  and  fabricated  by  the  Columbus  Aircraft  Division  of  Rock¬ 
well  International  Corporation.  Circuit  concepts  employed  in  the  unit  were  developed  under  com¬ 
pany  funded  I  R&D  projects.  Innovative  application  of  redundancy  and  feedback  techniques  permit 
EDU  operation  to  be  maintained  with  multiple  component  failures.  Although  the  assembly  was  de¬ 
signed  and  fabricated  to  be  suitable  for  flight,  the  EDU  was  nevertheless  an  experimental  model. 

The  assembly  contained  discrete  components,  test  points,  and  external  adjustments  to  facilitate  data 
acquisition.  This  resulted  in  a  much  larger  package  than  would  be  needed  for  a  production  unit. 

A  production  design  EDU  would  have  approximately  5%  of  the  volume  of  the  AFCAS  unit. 
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The  EDU  was  powered  by  1 15  volt  400  'V  AC  and  basically  had  two  channels  with  dual  sub-circuits 
(4  channels  total).  Bias  pots  were  provided  to  adjust  the  input,  feedback,  and  balance  of  each  chan¬ 
nel.  Two  power  supplies  provided  ±15  VDC  for  the  signal  amplifiers  and  system  transducers.  All 
circuitry  was  contained  on  two  identical  printed  circuit  boards. 

The  force  transducer  housing  assembly  was  designed  and  fabricated  by  CAD.  The  housing  contains 
two  DC-operated  LVDT  force  transducers  built  by  Schaevitz  Engineering  in  Camden,  New  Jersey. 
The  units  have  a  maximum  capacity  of  500  lb  (2.2  kN),  a  spring  rate  of  approximately  8,000  Ib/in 
{ 1.40  MN/m),  and  an  output  of  0.01  v/lb  (0.002  v/N)  in  tension  or  compression. 

A  simplified  block  diagram  of  all  elements  in  the  system  is  shown  on  Figure  88.  Pilot  inputs  are 
transmitted  through  the  rudder  pedals  via  cables,  pulleys,  and  bellcranks  to  the  force  transducer 
located  inside  the  vertical  stabilizer.  Gearing  multiplies  pilot  effort  by  2.28.  Transducer  output  is 
the  command  signal  (e;)  to  the  EDU.  Amplifiers  in  the  EDU  process  ej  with  a  feedback  signal  (efb) 
and  power  the  force  motor  coils  which  drive  the  spool  Xj  in  the  control  valve.  The  valve  ports 
8,000  psi  hydraulic  fluid  to  the  rudder  actuator  in  response  to  X;.  Actuator  piston  travel  is  sensed 
by  position  transducers  having  an  output  of  5  v/in;  this  is  the  feedback  signal  (efh).  Actuator  piston 
travel  (±  1.75  in.  max.)  is  converted  through  bellcrank  and  push  rod  to  angular  travel  of  the  rudder 
(±  12°  max.). 

A  simplified  diagram  of  electrical  tomponents  in  the  test  installation  is  presented  on  Figure  89. 
System  redundancy  is  illustrated  on  Figure  90.  The  system  concept  developed  under  CAD  IR&D 
studies  is  flexible  in  that  various  levels  of  redundancy  could  be  employed  (as  required)  for  other 
applications.  AFCAS  redundancy  features  include: 

•  Dual  force  (input)  transducers 

•  Dual  position  (feedback)  transducers 

•  Dual  power  supplies 

•  Quad  electronics 

•  Feedback  fault  correction 

Each  of  the  four  power  amplifers  in  the  EDU  employes  current  feedback  with  a  highly  reliable 
darlingto.i  power  transistor  configuration  and  independent  power  supplies.  The  circuitry  is  designed 
so  that  in  the  event  an  output  stage  fails  "hard-over,"  voltage  applied  to  a  motor  coil  will  not  exceed 
its  rated  value.  This  limiting  feature  permits  a  subunit  failure  to  be  compensated  or  nullified  by 
another  subunit.  Closed  loop  tests  reported  in  Reference  14  verified  that  operation  of  the  redundant 
subunits  provided  high  immunity  to  component  failures. 

A  math  model  of  the  idealized  system  is  presented  on  Figure  91.  The  transfer  functions  are  for 
"small  signal"  inputs  and  do  not  reflect  fluid  flow  saturation  limitations  or  motor  current  limita¬ 
tions  imposed  by  coil  inductance.  System  spring-mass  effects  (actuator  loaded)  were  not  included. 
Optimum  loop  gain  was  90;  this  provided  a  theoretical  band  width  of  14.3  Hz  and  a  damping  ratio 
of  0.7. 

Performance  characteristics  of  the  test  installation  were  higher  than  could  be  utilized  in  the  T-2C 
rudder  system.  To  assure  satisfactory  operation,  AFCAS  dynamics  were  matched  with  T-2C  di¬ 
rectional  system  dynamics.  This  was  accomplished  by  lowering  loop  gain  to  20  and  adding  high 
frequency  roll-off  filtering  to  reduce  the  possibility  of  system  noise. 


Figure  88.  Block  Diagram  of  System 
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Figure  90.  Simplified  Diagram  Showing  System  Redundancy 


Figure  91.  Mathematical  Model  of  the  AFCAS 
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d.  Instrumentation 

The  T-2C  was  equipped  with  several  flight  data  acquisition  systems.  Two  were  used  in  the  AFCAS 
program:  (1)  an  18  channel  telemetry  system,  and  (2)  a  21  hole  photo  recorder  system.  The 
telemetry  oscillator  package  was  located  in  the  aft  cockpit  seat  area;  the  photo  recorder  was  in¬ 
stalled  inside  the  nose. 

Telemetry  data  were  recorded  at  the  CAD  Telemetry  and  Data  Processing  Center  where  a  UHF 
receiving/tracking  system  provided  rrN-time  data  acquisition  and  direct  read-out  on  strip  charts. 
Audio  communication  with  the  pilot  was  available  for  convenience  and  safety  monitoring. 

Pilot  instrumentation  controls  were  located  above  the  cockpit  instrument  panel  and  on  the  control 
stick.  Data  in  the  two  recording  systems  were  related  by  means  of  correlator  numbers  printed  on 
the  photo  recorder  film,  and  correlator  blips  on  the  TM  strip  chart.  A  correlator  counter  could  be 
read  by  the  pilot  for  reference  purposes. 

New  equipment  installed  to  permit  the  pilot  to  monitor  and  control  the  AFCAS  system  were: 

•  An  indicator  was  provided  for  direct  readout  of  the  motor/pump  discharge  pressure 

•  A  switch  was  provided  to  turn  the  motor/pump  unit  "on"  and  "off" 

•  An  "oil  hot"  light  was  set  to  illuminate  when  hydraulic  fluid  in  the  motor/pump  suction  line 
exceeded  approximately  +200°F  (93°C) 

4.  Flight  Plan 

The  primary  objective  was  to  verify  the  feasibility  of  the  Advanced  Flight  Control  Actuation  System 
(AFCAS)  concept  by  flight  testing  a  control-by-wire,  direct-drive  actuation  system  powered  by  a 
localized  8,000  psi  (55  MPa)  motor/pump  unit  Demonstration  of  flying  qualities  was  not  part  of 
the  program,  however,  pilot  comments  were  encouraged.  Ten  flight  hours  were  expected  to  be  suf¬ 
ficient  to  evaluate  AFCAS  performance,  confirm  prior  analyses  and  laboratory  testing,  and  provide 
a  measure  of  confidence  in  system  reliability. 

The  flight  plan  was  designed  to  determine  directional  control  characteristics  at  several  altitudes  up 
to  30,000  ft.  (9.1  km)  and  various  speeds  up  to  340  knots  (174  m/s).  The  first  two  flights  were 
dedicated  to  confirming  satisfactory  operation.  Subsequent  flights  were  scheduled  to  evaluate  sys¬ 
tem  performance  and  reliability  while  accumulating  10  flight  hours.  Flight  plan  details  are  given  in 
Appendix  A  of  Reference  16. 

5.  Flight  Test  Results 

The  AFCAS  flights  are  summarized  on  Table  V  of  Reference  16.  Two  pilots  participated  in  the  pro¬ 
gram  and  prepared  reports  detailing  each  test  flight.  Additional  comments  were  made  during  flight 
de-briefings.  Both  pilots  stated  that  performance  of  the  AFCAS  test  installation  was  completely 
satisfactory.  Comments  made  by  the  pilots  concerning  their  flights  were: 

•  The  AFCAS  installation  worked  exactly  as  designed 

•  No  malfunctions  occurred 

•  System  pressure  was  steady 

•  Hydraulic  fluid  temperatures  were  normal 
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•  Directional  control  response  was  judged  to  be  superior  to  the  production  T-2C 

•  Pilot  adaptation  to  "force  control"  of  the  rudder  was  quickly  and  easily  acquired.  Reaction 
of  the  aircraft  provided  the  clues  to  close  the  loop. 

•  The  force  system  had  an  advantage  during  take-offs  and  landings  in  high  cross-winds.  The 
fixed  pedals  provide  full  rudder  and  allow  much  easier  braking  (in  combination)  without  severe 
leg  and  foot  extension  that  is  required  for  conventional  deflection  controls. 

6.  Summary 

A  direct-drive  control-by-wire  muscle  actuator,  powered  by  a  localized  8,000  psi  hydraulic  system, 
was  used  to  control  the  flight  of  a  T-2C.  Successful  operation  of  the  test  installation  represented  a 
significant  milestone  in  the  development  of  advanced  flight  controls.  No  problems  whatsoever  were 
encountered;  the  system  functioned  exceptionally  well  and  p».ot  response  was  favorable.  The  test 
results  confirmed  analyses  and  laboratory  investigations  reported  in  References  12  and  15.  The  ease 
with  which  flight  testing  was  accomplished  verified  that  AFCAS  type  systems  can  be  designed,  fab¬ 
ricated,  and  maintained  without  special  techniques  or  state-of-the-art  advances. 

The  AFCAS  concept  is  intended  for  application  to  automatic,  computer  operated  flight  control  sys¬ 
tems.  The  AFCAS  flights  described  in  Reference  16  did  not  demonstrate  the  full  performance 
capabilities  of  the  test  hardware  since  the  T-2C  did  nobhave  computer  operated  controls.  Company 
funded  investigations  at  the  Columbus  Aircraft  Division  verified  the  feasibility  of  controlling 
AFCAS  actuators  directly  by  a  digital  computer. 

FLIGHT  VERIFICATION  OF  DIRECT  DIGITAL  DRIVE  FOR  AN  AFCAS  IN  THE  T-2C 
AIRCRAFT 

The  objective  of  the  sixth  and  final  phase  of  the  AFCAS  program  was  to  demonstrate  that  AFCAS- 
type  actuators  can  be  directly  controlled  by  a  digital  computer.  The  computer  control  was  demon¬ 
strated  in  system  laboratory  tests  and  in  flight  tests  in  a  T-2C  twin-engine  turbojet  trainer. 

1.  Technical  Approach 

The  directional  control  system  of  a  T-2C  aircraft  was  changed  to  incorporate  a  full-powered  Digital 
Fly-By-Wire  (DFBW)  mode  with  an  Analog  Back-Up  (ABU)  mode.  The  test  installation  contained: 

•  Hydraulic  rudder  actuator 

•  Localized  hydraulic  power  unit 

•  Digital  microcomputer 

•  Electronic  drive  unit  (EDU) 

•  Associated  sensors,  wiring  and  power  supplies 

The  original  cable  system  between  the  rudder  pedals  and  rudder  was  changed  to  incorporate  the  fly¬ 
by-wire  test  installation.  The  rudder  pedal  cables  were  attached  to  a  sector  which  was  prevented  from 
rotating  by  a  force  transducer.  Force  on  the  pedals  was  converted  to  a  proportional  electrical  sig¬ 
nal  from  the  transducer.  This  command  signal  was  supplied  to  a  microcomputer  where  it  was  summed 
with  a  feedback  signal,  and  processed  into  a  pulse  width  modulated  (PWM)  error  signal.  The  PWM 
signal  was  power  amplified  in  the  EDU  which  powered  to  torque  motor  of  a  direct  drive  hydraulic 
rudder  actuator.  The  modified  system  provided  a  microcomputer  controlled,  hydraulically  powered 
rudder,  instead  of  the  manually  operated  rudder  of  the  basic  T-2C  aircraft 

The  hydraulic  system,  the  direct  drive  actuator,  the  EDU,  the  LVDT  actuator  position  feedback 
transducer,  and  the  pedal  force  transducers  were  installed  and  flight  tested  in  the  T-2C  during 
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Phase  V.  The  Phase  VI  system  was  designed  so  that  the  signals  from  the  transducers  could  be 
switched  from  the  microcomputer  unit  directly  into  the  EDU  to  provide  an  ABU  mode  with  the 
same  control  capability  as  the  Phase  V  flight  system.  The  ABU  mode  could  be  selected  manually, 
or  selected  automatically  if  the  microcomputer  monitor  detected  abnormal  operation. 

The  safety  provisions  of  the  Phase  V  program  were  included  in  this  phase.  The  direct-drive  8,000 
psi  (55  MPa)  rudder  actuator,  designed  and  fabricated  in  Phase  IV,  was  equipped  with  a  bypass 
valve.  This  device  allowed  the  rudder  to  seek  the  trail  position  if  system  pressure  were  lost  In  the 
event  of  a  system  failure,  the  pilot  could  permit  the  rudder  to  trail  by  turning  the  8,000  psi  (55  MPa) 
supply  "off." 

All  major  components  in  the  test  installation  were  assembled  in  the  laboratory  for  integration  test¬ 
ing.  System  operation  was  verified  in  the  laboratory  prior  to  aircraft  installation.  Frequency  re¬ 
sponse  tests  and  temperature-altitude  tests  were  performed  simulating  aircraft  operation. 

The  test  system  was  installed  in  a  T-2C  with  instrumentation  for  electrical  and  hydraulic  operation. 
Standard  parameters  such  as  air  speed,  altitude,  engine  rpm,  etc.,  also  were  instrumented.  Flight 
data  were  collected  by  photorecorder  and  telemetry  systems. 

Procedures  were  established  for  system  checkout,  ground  demonstration,  and  flight  testing.  More 
than  four  and  one-half  hours  of  flight  time  were  logged  on  the  test  system  at  various  altitudes  and 
airspeeds.  Pilot  observations  and  instrumentation  data  were  used  as  a  basis  for  evaluating  the  test 
system. 

2.  Description  of  the  AFCAS  Direct  Digital  Drive  (D^)  Test  Installation 

The  fly-by-wire  rudder  control  system  test  installation,  originally  installed  in  the  T-2C  aircraft  during 
Phase  V  of  the  AFCAS  program  was  modified  to  test  a  digital  microcomputer  generated  PWM  valve 
drive  signal  (Phase  VI  of  the  AFCAS  program).  Principal  components  in  the  test  installation  are: 


•  EDU 

•  Localized  Hydraulic  Power  Unit  (8,000  psi) 

•  Force  Transducers 

•  LVDT  Position  Transducers 

Previously  installed  and 
tested  per  Phase  V  of 
the  AFCAS  program. 

•  Microcomputer  Assembly 

•  Microcomputer  Power  Supply 

Installed  and  tested  per 
Phase  VI  of  the  AFCAS 
program. 

Two  modes  of  system  operation  are  provided,  the  DFBW  mode  and  the  ABU  mode.  In  the  DFBW 
mode,  the  microcomputer  converts  the  pedal  force  command  and  rudder  position  feedback  outputs 
into  digital  signals  which  are  summed,  amplified,  and  converted  into  PWM  signals.  The  PWM  signals 
are  sent  to  each  of  two  channels  in  the  EDU  where  the  signals  are  amplified  and  power  converted 
into  four  torque  motor  PWM  currents.  In  the  ABU  mode,  the  pedal  force  commands  and  rudder 
position  feedback  outputs  bypass  the  microcomputer  and  are  connected  directly  to  the  EDU  where 
they  are  summed,  amplified,  and  power  converted  into  four  torque  motor  currents. 

Figure  92  shows  a  simplified  block  diagram  of  the  T-2C  Direct  Digital  Drive  AFCAS  test  installation. 
The  DFBW  engage/disengage  functions  are  implemented  by  a  cockpit  control  switch  located  adjacent 
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Figure  92.  Simplified  Block  Diagram  of  T-2C  AFCAS  Direct  Digital  Drive  (D3)  Test  Installation 
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to  the  AFCAS  power  switch  on  the  Pilot's  Auxiliary  Instrument  Control  Panel.  After  the  AFCAS 
analog  system  has  been  engaged,  DFBW  control  will  be  selected  by  momentarily  holding  the  DFBW 
engage  switch  to  "ON".  The  DFBW  control  relays  will  energize  to  switch  the  transducer  outputs  to 
the  microcomputer,  and  connect  the  microcomputer  output  to  the  EDU.  When  the  microcomputer 
functions  are  operating  correctly,  a  +28  volt  DC  power  ground  will  be  supplied  to  the  holding  coil 
of  the  cockpit  DFBW  engage  switch.  Disengagement  of  DFBW  control  will  result  from  the  follow¬ 
ing:  manually  selecting  the  DFBW  engage  switch  to  "OFF",  automatically  by  the  loss  of  the  micro¬ 
computer  supplied  ground,  or  by  manually  selecting  the  AFCAS  power  switch  to  "OFF". 

a.  Microcomputer  Assembly 

The  microcomputer  assembly  is  housed  in  an  enclosed  unit,  and  consists  of  the  following  subassem¬ 
blies: 


•  Motorola  Mono-Board  Microcomputer  Module 

•  Analog-To-Digital  (A/D)  Converter  Module 

•  Digital-To-Analog  (D/A)  Converter  Module 

•  Card  Cage  &  Mother  Board  Assembly 

•  Signal  Conditioning  Board 

The  mono-board  microcomputer  module  is  a  complete  computer-on-a-board  having  all  the  process¬ 
ing  and  control  required  for  a  microcomputer-based  system.  It  incorporates  the  MC  6800  MPU,  1  K 
of  Random  Access  Memory  (RAM),  provisions  for  4  K  of  Programmable  Read  Only  Memory  (PROM), 
timing  and  control,  buffers,  an  Asychronous  Interface  Adapter  (ACIA)  and  two  Peripheral  Interface 
Adapters  (PI A). 

The  A/D  converter  module  consists  of  eight  channels  of  A/D  conversion  of  which  four  are  utilized. 
The  D/A  converter  module  consists  of  four  channels  of  D/A  conversion  of  which  three  are  utilized. 

The  signal  conditioning  board  contains  four  channels  of  sensor  signal  conditioning  and  a  relay  driver 
that  interfaces  the  microcomputer  monitor  output  with  the  system  control  logic. 

Additional  information  on  the  microcomputer  assembly  is  contained  in  Appendix  A  of  Reference 
17. 

A  separate  power  supply  converts  single-phase,  115  VAC,  400  HZ  to  +  5  VDC,  and  ±  12  VDC  to 
power  the  microcomputer  assembly. 

b.  Software  Description. 

Software  was  developed  to  enable  the  microcomputer  to  perform  two  basic  functions;  a  command/ 
feedback  control  function  and  a  control  monitor  function. 

The  command/feedback  control  function  sums  the  pilot  command  and  rudder  position  signals  to 
produce  an  output  signal  proportional  to  the  difference  to  drive  the  actuator. 

The  control  monitor  function  measures  the  level  of  error  between  the  pedal  command  the  the 
rudder  actuator  position  feedback,  and  if  a  preset  level  is  exceeded  for  a  given  period  of  time,  the 
engage  command  will  be  removed.  Actuator  control  will  then  revert  to  the  ABU  mode.  A  contin¬ 
uous  check  is  also  made  on  the  transducer  input  A/D  conversion  hardware  by  comparing  the  two 
digital  feedback  signals  with  each  other  and  in  a  similar  manner  comparing  the  digital  pedal  signals. 
Any  differences  exceeding  preset  levels  for  a  given  period  of  time  will  result  in  switching  system 
control  to  the  ABU  mode. 
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The  control  monitor  function  was  incorporated  as  the  Motorola  microcomputer  is  a  single  channel 
device  which  could  generate  a  "hardover"  command  under  certain  failure  conditions.  The  dual¬ 
channel  redundancy  of  the  ABU  mode  prevents  a  "hardover"  command  of  the  rudder  even  if  a 
pedal  transducer  or  rudder  position  transducer  fails  in  a  "hardover"  condition. 

c.  Program  Modules 


The  DFBW  Microcomputer  Program  Flow  Chart,  Figure  93,  illustrates  the  modular  nature  of  the 
software  and  the  sequence  in  which  the  modules  function.  The  program  modules  were  designed, 
coded,  and  initially  checked  as  individual  entities  prior  to  being  integrated. 


OUTPUT 


Figure  93.  Digital  Fly-By-Wire  Microcomputer  Program  Flow  Chart 
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Following  is  a  brief  description  of  the  program  modules: 

Initialize  -  The  Initialize  module  sets  the  D/A  Converter  (DAC)  channel  4  to  provide  +5  VDC  to 
hold  in  a  relay.  The  relay,  in  turn,  holds  the  DFBW  Engage  switch  in  the  engage  position.  This 
module  also  sets  timing  counters  to  ensure  that  the  Monitor  function  does  not  immediately  turn  off 
the  DFBW  Engage  switch. 

Input  1  -  The  Input-1  module,  as  the  first  in  the  repetitive  loop,  is  used  to  start  the  PWM  output 
signals.  This  is  done  by  setting  both  DAC-1  and  DAC-2  at  +10  VDC.  It  then  controls  the  A/D  con¬ 
versions  of  pilot  command  (CMD1 )  and  rudder  position  (POS1 ).  Inputs  are  scaled  so  that  full  scale, 
±12°  of  rudder  is  ±5  VDC,  which  is  one-half  of  full  range  for  the  A/D  channels.  Since  the  force 
transducer  that  provides  CMD1  is  not  mechanically  or  electrically  limited  to  ±5  VDC,  a  software 
limit  is  provided  to  set  CMD1  at  either  ±5  VDC,  as  appropriate,  when  that  value  is  exceeded.  Out¬ 
put  of  the  A/D  converter  is  a  12  bit  word,  proportional  to  the  voltage. 

Error  -  The  error  module  performs  a  double  precision  subtract  of  CMD1  from  POS1  and  sets  com¬ 
puter  gain  through  a  series  of  shifts.  It  then  determines  polarity  of  the  error  and  transfers  to  the 
appropriate  output  module. 

Output  -  The  output  module  sets  countdown  timers  that  establish  the  duration  of  the  plus  and 
minus  portions  of  the  PWM  output  signal.  It  switches  DAC-1  and  DAC-2  to  -10  VDC  when  the 
"positive"  counters  have  timed-out.  When  the  "minus"  counters  time-out,  it  transfers  control  to 
the  Input  2  module. 

Input  2  -  The  Input  2  module  controls  the  conversion  of  CMD2  and  POS2  and  provides  limits  on 
CMD2  in  the  same  manner  as  Input  1 .  CMD2  and  POS2  are  for  use  in  the  Monitor  functions. 

Monitor  -  The  Monitor  module  compares  the  redundant  pilot  command  and  rudder  position  input 
signals.  If  a  difference  in  either  of  1 .5°  is  detected  for  a  period  of  0.1 28  seconds,  the  program  is 
set  to  deenergize  the  DFBW  holding  relay  and  reverts  control  of  the  system  into  the  ABU  mode. 

The  monitor  also  checks  the  magnitude  of  the  error  signal.  If  it  exceeds  1.5°  for  2  seconds,  the 
DFBW  holding  relay  is  deenergized,  and  control  of  the  system  again  reverts  to  the  ABU  mode.  As 
long  as  the  monitor  does  not  detect  an  error,  it  transfers  control  back  to  the  Input  1  module. 

d.  Flight  Test  Program  Software 

Support  software,  trade  name  "Microbug  ROM"  was  purchased  with  the  microcomputer  equipment 
and  enabled  communications  with  the  microcomputer  via  a  Teletype  Corp.  Model  33TU  teletype 
keyboard/printer  reader/punch  unit.  An  RS-232-TO-TTY  adapter  unit  provided  the  interface 
through  the  Asynchronous  Interface  Adapter  (ACIA),  between  the  microcomputer  and  the  teletype. 

The  communication  consisted  of  entering  both  program  and  simulated  input  data,  monitoring 
microcomputer  operation,  and  dumping  of  programs  onto  paper  tape  for  storage. 

After  the  software  modules  were  operating  satisfactorily  they  were  then  merged  to  become  an 
operational  program.  After  checking  the  operational  program  the  microcomputer  integrated  into 
the  rudder  system  (in  the  laboratory),  the  program  was  then  loaded  into  a  PROM.  The  PROM  was 
installed  in  the  microcomputer  and  the  operational  program  verified.  All  subsequent  final  system 
response  testing  and  calibration  for  the  flight  configuration  was  performed  with  this  PROM  installed 
in  the  microcomputer. 

A  listing  of  the  flight  program  software  is  contained  in  Appendix  B  of  Reference  17.  The  program 
was  designed  to  function  at  a  rate  of  500  HZ,  and  occupies  462  bytes  of  the  available  4096  bytes 
of  PROM  and  18  bytes  of  1024  bytes  of  "scratch  pad”  RAM.  The  PROM  map  is  also  shown. 
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e.  Microcomputer  Analog  and  Reduced  Bit  Resolution  Program  Software 

In  addition  to  the  PROM  software  developed  for  the  flight  test  program,  additional  software  pro¬ 
grams  were  developed  to  evaluate  microcomputer  performance  as  a  function  of  reduced  bit  resolu¬ 
tion  and  various  PWM  frequencies.  These  programs  were  designed  for  lab  testing  only,  and  were 
therefore  stored  on  paper  tape  and  entered  into  the  microcomputer  memory  via  the  teletype. 

f.  Laboratory  Tests 

Laboratory  tests  were  performed  to  integrate  the  microcomputer  into  the  existing  Phase  V  AFCAS 
system,  evaluate  system  performance  and  compatibility  with  the  microcomputer  operational  modes 
and  software,  and  to  ensure  the  equipment  would  function  properly  in  the  T-2C  aircraft  environment 
prior  to  installation  in  the  aircraft. 

The  DFBW  and  ABU  system  operating  modes  were  evaluated  in  the  laboratory.  In  the  ABU  mode, 
the  microcomputer  is  disconnected  from  the  loop,  and  the  aircraft  sensors  directly  control  the  actu¬ 
ator  through  the  EDU.  This  was  the  control  used  in  Phase  V  of  this  program.  Laboratory  testing 
was  also  accomplished  with  the  microcomputer  supplying  an  analog  signal  instead  of  a  PWM  signal 
to  the  EDU.  This  testing  was  performed  to  obtain  comparison  data  with  the  computer  in  the  loop. 

The  actual  aircraft  hardware  was  used  whenever  possible  in  the  lab  test  set-up  to  permit  testing  and 
evaluation  of  the  flight  hardware  and  to  eliminate  potential  problems  during  subsequent  installation 
and  operation  in  the  aircraft. 

Included  in  the  lab  test  set-up  were  the  rudder  LVDT  feedback  transducers,  rudder  actuator,  EDU, 
microcomputer  and  associated  power  supply,  and  the  control  panel  switches  and  control  relay  used 
in  the  aircraft.  The  8000  psi  (55  MPa)  hydraulic  pump,  incorporated  in  the  aircraft  for  the  AFCAS 
installation,  was  not  included  in  the  lab  set-up  since  the  pump  performed  successfully  in  the  previous 
Phase  V  of  the  AFCAS  program  and  the  potential  benefits  from  including  it  in  the  lab  set-up  did  not 
warrant  the  added  expense.  An  8000  psi  (55  MPa)  laboratory  hydraulic  pump  was  utilized  for  all 
tests  requiring  high  pressure  hydraulic  flow. 

A  block  diagram  of  the  laboratory  set-up  is  shown  in  Figure  94. 
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Figure  94.  Laboratory  Test  Setup  Block  Diagram 
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3.  Flight  Test  Program 

a.  Flight  Plan 

The  primary  objective  of  the  Flight  Test  Program  was  to  evaluate  performance  of  the  computer- 
controlled  direct  digital  fly-by-wire  characteristics  of  the  AFCAS  in  a  T-2C  aircraft.  Approximately 
three  flight  hours  were  expected  to  be  sufficient  to  evaluate  performance,  confirm  prior  analyses 
and  laboratory  tests,  and  provide  a  measure  of  confidence  in  system  reliability. 

The  flight  plan  was  designed  to  determine  digital  control  characteristics  at  altitudes  up  to  30,000 
feet  (9.1  km)  and  speeds  up  to  340  knots  (175  m/sec.)  and  to  compare  performance  between  the 
DFBW  and  ABU  modes  of  operation. 

Details  of  the  flight  plan  are  included  in  Appendix  C  of  Reference  17. 

b.  Flight  Test  Results 

Three  flights  were  flown  for  a  total  of  4.7  hours.  The  pilot  stated  that  performance  of  the  Direct 
Digital  Drive  AFCAS  test  installation  was  completely  satisfactory.  No  difference  in  "feel"  was 
noted  between  the  DFBW  and  ABU  modes  of  operation.  Additional  pilot  comments  were  similar 
to  those  listed  in  the  Phase  V  AFCAS  flight  test  program  contained  in  Reference  16,  and  included: 

—  Directional  Control  Response  was  judged  to  be  superior  to  the  production  T-2C. 

—  Pilot  adaptation  to  "force  control"  of  the  rudder  was  quickly  rnd  easily  acquired. 

—  The  fixed  pedals  provide  full  rudder  and  allow  much  easier  braking  (in  combination)  without 
severe  leg  and  foot  extension  that  is  required  for  conventional  deflection  controls. 

—  Hydraulic  system  fluid  pressure  and  temperature  were  normal. 

—  No  malfunctions  occurred. 


c.  Flight  Program  Summary 

Following  is  a  summary  of  the  Direct  Digital  Drive  AFCAS  flight  program: 


FLIGHT 

MAX.  AIR  SPEED  &  ALTITUDE 

NZ 

DURATION 

1 

250  KOAS  &  20,000  FT. 

3.0"g" 

1 .4  Hours 

2 

250  KOAS  &  20,000  FT. 

3.0"g" 

1.5  Hours 

3 

340  KOAS  &  30,000  FT. 

5.5"g" 

1 .8  Hours 

ROCKWELL'S  STUDIES  OF  PULSE  MODULATED  DIRECT  DIGITAL  DRIVE  (D3)  CONCEPTS 


In  advanced  aircraft  using  digital  fly-by-wire  control,  direct-drive  actuators  show  considerable  advan¬ 
tages  because  of  their  ruggedness,  relative  simplicity  and  high  reliability.  Both  the  Navy  and  Air 
Force  have  research  programs  under  way  to  develop  direct  drive  actuation. 

Previous  work  on  this  project  has  demonstrated  that  low  level  analog  signals,  such  as  are  provided  by 
a  D/A  converter,  can  be  suitably  amplified  into  the  high  power  forms  required  for  closed  loop  con¬ 
trol.  Analog  valve  drivers  using  quadruple  redundancy  and  optimized  for  linear  (Class  A)  operation, 
were  successfully  tested  and  demonstrated  in  the  laboratory.  A  modified  PDP-1 1  minicomputer  with 
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built-in  A/D  and  D/A  converters  was  used  to  close  the  loop  both  internal  and  external  to  the  mini¬ 
computer.  Flight  worthy  analog  valve  drivers  were  developed  with  I  R&D  funds.  This  design  was 
fabricated  and  flown  under  Phase  V  of  the  AFCAS  program. 

Following  Phase  V,  additional  I  R&D  research  was  conducted  to  develop  an  approach  that  would 
(a)  eliminate  the  need  for  D/A  and  A/D  converters  and  (2)  reduce  the  cooling  requirements  of  the 
drive  amplifiers. 

Experiments  were  performed  using  error  signals  in  various  pulsed  formats  including  "bang-bang" 
pulse  width  modulation  and  time  dwell  modulation. 

The  use  of  pulsed  drive  waveforms  offers  several  potential  advantages: 

•  D/A  converters  are  not  needed,  since  digital  circuitry  can  generate  the  pulsed  waveforms. 

•  A/D  converters  for  "wrap-around"  monitoring  are  not  needed. 

•  Pulsed  waveforms  allow  the  valve  driver  amplif  iers  to  act  as  switches  rather  than  as  linear 
amplifiers.  As  a  result,  the  power  dissipation  in  the  drive  transistors  can  be  reduced  by  a 
factor  of  10  or  more,  thereby  improving  the  reliability  and  reducing  the  weight  of  the  DFBW 
system  is  also  improved  as  a  result  of  the  lower  power  dissipation. 

•  Dynamic  pulsed  waveforms  are  compatible  with  passive  fault  isolation  schemes  whereby  a 
hardover  computer  output  can  be  blocked  without  the  need  for  a  disconnect  arrangement. 

The  results  were  sufficiently  encouraging  to  warrant  investigations  into  a  new  digital  valve  driver 
amplifier  concept  better  suited  to  pulsed  waveforms  than  are  the  linear  analog  drivers,  and  designed 
to  exploit  the  potential  advantages  offered  by  the  use  of  pulsed  waveforms  in  aircraft  having  several 
actuation  systems  under  direct  digital  control. 

The  digital  drive  concept,  illustrated  in  Figure  95,  was  constructed  and  tested.  The  typical  wave¬ 
forms  are  illustrated  in  Figure  96.  The  circuit  incorporates  two  features  which  reduce  the  size  and 
weight  over  that  of  an  analog  drive.  First,  the  transistors  operate  in  a  switching  mode  to  reduce  the 
internal  power  dissipation.  Second,  the  circuit  is  designed  to  operate  from  a  single  polarity  power 
supply. 

In  addition  the  circuit  can  be  designed  for  dynamic  operation,  that  is,  a  pulse  rate  is  required  to 
obtain  an  output.  The  absence  of  pulses  results  in  zero  output.  If  some  form  of  AC  coupling  is 
provided  between  the  computers  and  the  power  amplifier,  a  hardover  failure  of  a  computer  output 
circuit  would  result  in  a  passive  failure  and  not  a  hardover  failure.  This  permits  the  computers  to 
perform  self-monitoring  and  remove  themselves  from  the  line  if  a  failure  occurs.  It  does  not  matter 
if  the  computer  output  is  zero  or  a  plus  voltage,  it  is  still  removed  from  the  drive.  This  provides 
opportunities  for  many  forms  of  redundancy  in  the  actuator  drive. 

The  breadboard  digital  driver  was  tested  as  a  part  of  the  closed  loop  system.  A  direct  drive  torque 
motor  was  used  to  provide  a  realistic  load  for  the  driver.  A  simulated  actuator  was  configured  to 
enable  studying  the  dynamic  response  of  the  loop,  which  was  closed  by  the  computer.  The  com¬ 
puter  generated  the  "surface  error  signal"  in  the  pulse  modulation  format.  The  following  specific 
results  were  achieved' 

1.  The  circuit  concept  was  verified  and  a  data  base  was  established  for  use  in  optimizing  future 
operational  circuit  designs. 
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2.  The  closed  loop  test  results  showed  that  the  desired  closed  loop  frequency  response  can  be 
obtained  with  proper  compensation  for  the  inductive  characteristics  of  the  valve  coil. 

3.  The  qualitative  effects  of  pulsed  waveforms  on  the  torque  motor  were  evaluated  and  found  to 
have  little  effect  on  the  motor  when  operated  at  frequencies  above  500  Hz. 

The  closed  loop  frequency  response  without  any  form  of  compensation  is  shown  in  Figure  97. 

With  computer  compensation  this  bandwidth  can  be  extended  for  small  signals  (1%  of  full  travel) 
by  a  factor  of  4  to  about  26  Hz.  This  is  illustrated  in  Figure  98. 

For  certain  dynamic  situations,  large  changes  in  the  surface  displacement  would  be  desired  requiring 
increased  bandwidth  for  large  signals. 

Resistance  in  series  with  the  motor  coil  is  the  simplest,  most  effective  means  of  providing  the  needed 
compensation.  The  resultant  large  stroke  response  is  shown  in  Figure  98.  This  method  also  offers 
the  advantage  of  maintaining  valve  driver  power  bandwidth  over  the  full  range  of  error  signal  levels 
—  that  is,  the  large  signal  response  is  identical  with  the  small  signal  response.  The  closed  loop  band¬ 
width  will  be  limited  only  by  the  rate  capacity  of  the  actuator  itself.  The  use  of  a  series  resistor 
provides  an  additional  advantage  of  current-limiting  protection  in  the  event  of  a  hardover  failure. 

This  work,  performed  under  company  I  R&D  funds,  demonstrated  a  method  to  take  maximum  ad¬ 
vantage  of  pulse  modulated  control.  While  pulse  modulation  performs  satisfactorily  with  analog 
(Class  A)  amplifiers,  the  use  of  drive  circuits  designed  especially  for  pulse  modulation  produces  a 
significant  reduction  in  size  and  power  (heating)  dissipation  in  the  drive  circuit.  Because  of  the  low 
power  dissipation  of  the  electronics,  the  temperature  rise  is  slight  and  the  electronics  could  be  pack¬ 
aged  directly  into  the  surface  actuator.  A  direct  drive  actuator  design  that  utilizes  electronics  of 
this  type  integrated  into  the  actuator  has  been  developed  by  Rockwell. 

FLIGHT  CONTROL  COMPUTER  COMPLEX  -  D3  ACTUATOR  INTERFACE  (obtained  from 
Reference  18) 

While  the  simplification  of  the  surface  actuator  is  significant,  the  major  advantage  of  the  direct 
drive  concept  is  the  reduced  complexity  of  the  computer-actuator  interface.  This  is  achieved  be¬ 
cause  the  direct  drive  concept  provides  methods  of  failure  monitoring  and  redundancy  management 
that  are  more  compatible  with  digital  technology.  The  direct  drive  torque  motor  is  compatible 
with  digital  technology.  The  direct  drive  torque  motor  is  compatible  with  digital  (pulse  modulation) 
control  circuits.  Pulse  modulated  signals  eliminate  the  need  for  analog  signal  transmission  and  can 
be  generated  with  digital  timing  circuits.  Power  amplification  can  be  accomplished  using  highly 
efficient  switching  amplifiers.  The  direct  digital  drive  provides  several  options  in  failure  monitoring 
and  redundancy  management  and  can  be  used  for  triplex  or  quadruplex  systems.  It  can  also  be  used 
in  conventional  redundancy  management  systems  and  is  suitable  for  a  fault  tolerant  design. 

1.  Pusle  Modulation  Command 

The  use  of  an  electromechanical  force  motor  to  power  the  main  control  valve  requires  electrical 
power  amplification  to  replace  the  hydraulic  power  amplification.  While  servo  power  amplifiers, 
capable  of  handling  the  power  requirement  (25  to  50  watts)  are  readily  available,  the  characteristics 
of  the  force  motor  are  advantageous  for  other  methods  of  power  amplification.  The  force  motors 
are  limited  travel  devices  with  the  windings  having  fixed  resistance  and  inductance  typical  of  electro¬ 
magnetic  coils  rather  than  the  characteristics  of  a  motor.  Utilizing  the  R/L  time  constant  of  the 
coil  winding  as  a  filter  makes  the  force  motor  well  suited  to  the  use  of  pulse  modulated  techniques. 
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Figure  96.  Digital  Drive  Concept  Waveforms 
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Figure  97.  Closed  Loop  Response  (Uncompensated) 


Figure  98.  Effect  of  Compensation  Method  on  Closed  Loop  Response 
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Pulse  modulation  signals  can  be  generated  with  simple  digital  timing  circuits  and  the  actual  power 
amplification  can  be  accomplished  in  switching  circuits,  eliminating  the  need  for  analog  servo  ampli¬ 
fiers. 

Table  9  lists  the  characteristics  of  the  torque  motors  used  in  the  AFCAS  program.  Several  forms 
of  pulse  modulation  have  been  evaluated  including  pulse  width  modulation  (PWM),  time  dwell  mod¬ 
ulation,  and  an  on-off  or  "bang-bang"  control.  While  all  three  types  of  modulation  are  usable, 
pulse  width  modulation  proved  superior  for  small  signals,  offering  the  best  response  and  linearity. 
This  occurs  because  PWM  uses  a  constant  carrier  frequency  with  the  signals  producing  only  slight 
changes  in  the  plus  and  minus  portions  of  the  wave.  Other  forms  of  pulse  modulation  require  a 
much  wider  bandwidth  to  accommodate  the  frequency  variations. 

The  modulation  rate  must  be  selected  to  meet  the  requirements  of  the  electromechanical  force 
motor.  The  rate  of  modulation  must  be  greater  than  the  natural  mechanical  frequency  of  the  force 
motor  and  also  well  in  excess  of  the  R/L  time  constant  of  the  motor  coils.  When  these  requirements 
are  met,  the  characteristic  wave  shapes  shown  in  Figure  99  will  be  present  at  the  motor.  While  the 
signal  voltage  to  the  switching  amplifier  will  be  pulsed,  the  current  through  the  force  motor  windings 
will  be  well  filtered  by  the  inductance  of  the  coils. 


TABLE  9  -  ELECTROMECHANICAL  FORCE  MOTOR  DATA 


COILS  PER  MOTOR 

4 

VOLTS  PER  COIL 

10V 

CURRENT  PER  COIL 

0.8A  (RATED  TORQUE) 

COIL  RESISTANCE 

10  OHMS  .  . 

COIL  INDUCTANCE 

0.6  H. 

POWER  PER  COIL 

8  WATTS  (RATED  TORQUE) 

NATURAL  FREQUENCY 

-  230  Hz 

SHEAR  OUT  FORCE 

80  LBS  (RATED) 

The  principle  of  the  switching  circuit  is  quite  simple  as  illustrated  in  the  schematic  of  Figure  95. 
There  is  one  switching  amplifier  for  each  channel  of  redundancy.  This  form  of  switching  amplifier 
offers  several  advantages.  By  using  four  switches  operating  in  odd  or  even  pairs  (Q1  &  Q3  or  Q2  & 
Q4)  a  single  switch  failure  will  not  cause  a  hardover  coil  command.  However,  a  single  switch  failure 
will  cause  excessive  current  as  half  the  cycle  will  produce  a  shorted  supply,  thus  making  current 
monitoring  a  positive  fault  indicator. 

Signal  amplifiers  A1  and  A2  are  used  to  buffer  the  input  signals.  A  failure  in  either  of  these  stages 
cannot  cause  a  hardover  command,  but  will  result  in  a  bias  current  in  the  switching  amplifier  that 
can  be  readily  detected  and  the  power  source  subsequently  turned  off.  If  the  pulse  modulated  in¬ 
put  signal  is  AC  coupled,  pulses  are  required  for  the  signal  to  be  transmitted  to  the  switching  ampli¬ 
fier.  A  lack  of  pulses  results  in  a  fail  passive  circuit,  even  if  the  command  voltage  were  to  remain  in 
a  full  on  condition. 

The  pulse  modulated  command  signals  can  be  generated  by  the  computer  if  cycle  time  is  not  a  con¬ 
cern.  The  pulse  modulated  signal  can  also  be  generated  by  simple  timing  circuits  consisting  of 
several  logic  gates  and  a  counter.  The  exact  design  will  vary  with  the  application.  The  Motorola 
timer  MC6840  is  one  method  of  generating  a  PWM  signal  that  is  very  flexible  for  test  work.  This 


150 


NADC-82240-60 


chip  is  under  computer  control  and  the  modulation  characteristics  can  be  readily  varied.  In  flight 
tests  performed  at  Rockwell  using  the  direct  drive  actuator  in  the  rudder  system  of  the  T-2C  aircraft, 
the  pulse  modulated  signal  was  generated  by  the  computer.  For  these  test  programs,  closing  the  loop 
through  the  computer  had  advantages  for  monitoring  system  operation,  and  computer  cycle  time 
was  not  a  concern. 

The  switching  amplifier  that  produces  the  main  power  amplification  can  be  located  at  the  computer, 
the  actuator,  or  anywhere  in  between.  The  most  desirable  location  will  usually  be  at  or  in  the  actu¬ 
ator.  This  eliminates  the  need  for  transmission  of  analog  power  signals  and  permits  power  monitor¬ 
ing  to  verify  the  current  used  at  the  electromechanical  force  motor  rather  than  on  the  transmission 
side  of  the  drive.  The  approach  requires  two  additional  wires  per  stage  to  transmit  power  to  the 
actuator. 

2.  p3  Redundancy  Concept 

The  redundancy  concept  shown  in  Figure  100  for  a  quadruplex  direct  drive  actuation  is  very  similar 
to  existing  redundancy  concepts.  The  dual  tandem  actuator  employs  two  electromechanical  force 
motors  driving  the  main  control  valve.  Each  force  motor  contains  four  windings.  Each  of  four 
switching  amplifiers  drive  two  windings  in  series,  one  from  each  force  motor.  The  switching  ampli¬ 
fiers  are  driven  by  a  PWM  signal  from  four  separate  computers,  eliminating  the  need  to  transmit 
analog  information.  As  the  switching  amplifier  is  driven  into  saturation,  neither  the  quality  or  exact 
DC  level  of  the  power  source  are  critical  and  will  not  effect  loop  gain.  The  power  (current)  supplied 
to  each  switching  amplifier  is  monitored  at  the  source.  When  improper  power  measurements  are  ob¬ 
served,  the  power  source  can  be  switched  off.  It  is  assumed  that  the  aircraft  electrical  power 
concept  for  the  drive  circuits  will  be  the  same  as  for  the  computers. 

The  switching  amplifiers  operate  very  efficiently  with  the  switches  either  at  zero  voltage  drop  or 
zero  current.  The  power  dissipation  in  the  amplifier  is  no  greater  than  the  present  class  A  servo 
amplifiers  used  to  power  the  electrohydraulic  valves.  The  switching  amplifiers  are  not  gain  sensitive, 
and  temperature  effects  on  components  will  not  affect  system  operation.  This  makes  it  practical  to 
locate  the  switching  circuits  in  the  higher  temperature  environment  of  the  actuator.  Locating  the 
switching  amplifier  at  the  actuator  permits  transmitting  non-critical  pulse  modulated  signals  and 
non-critical  power  to  the  actuator.  The  command  signal  is  now  a  digital  signal  instead  of  a  low  level 
analog  signal. 

Since  the  pulse  modulated  command  signals  are  generated  by  timing  circuits,  it  is  possible  to  moni¬ 
tor  the  command  signals  to  a  greater  precision  than  possible  with  an  analog  drive.  This  enhances 
the  monitoring  of  the  computer  outputs  and  allows  the  computers  to  increase  the  accuracy  of  self 
test.  Computer  redundancy  requirements  become  less  critical  with  improved  output  monitoring 
which  should  make  the  triplex  system  very  attractive  to  actuation. 

The  redundancy  concept  shown  in  Figure  100  is  functionally  quite  similar  to  present  systems.  The 
only  significant  redundancy  difference  is  the  location  of  the  force  monitor  and  channel  turn-off 
switches  at  the  computer.  In  present  systems  multiple  hydraulic  force  monitors  and  solenoids  must 
be  located  in  the  actuator  environment.  This  greatly  increases  the  number  of  wires  required  between 
the  actuator  and  computer.  Present  systems  need  80  to  100  wires  compared  to  approximately  30 
for  the  system. 

3.  Fault  Tolerant  Redundancy 

In  the  direct  drive  system  presently  under  test,  loop  gains  in  excess  of  90  (15  Hz)  are  possible  be¬ 
cause  of  the  excellent  dynamics  of  the  direct  drive  torque  motor.  With  this  high  loop  gain,  a  hard- 
over  failure  of  one  of  the  four  channels  will  cause  a  bias  shift  at  the  actuator  of  less  than  1%  of  its 
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total  travel.  In  some  applications,  surface  responses  of  15  Hz  are  not  desirable.  The  use  of  lower 
loop  gains  will  cause  a  corresponding  increase  in  the  bias  error  due  to  a  single  channel  failure. 

One  approach  to  reduce  the  bias  error  of  a  failure  is  to  use  four  drivers  per  actuator  stage  (eight  per 
dual  actuator).  This  will  reduce  the  bias  error  of  a  single  "hardover"  failure  by  more  than  a  factor 
of  2  and  will  allow  the  unit  to  continue  operation  with  up  to  3  identical  “hardover"  failures  in  the 
drive  electronics.  With  this  approach,  current  monitoring  and  switching  would  not  be  required.  The 
simplicity  of  the  switching  amplifier  makes  this  a  reasonable  approach.  The  use  of  an  interloop 
feedback  (monitoring  force  motor  position)  is  also  a  valid  approach  to  reducing  effects  of  hardover 
failures,  but  adds  considerable  complexity  to  the  overall  interface. 

As  shown  earlier,  single  failures  of  the  switching  circuit,  while  not  producing  "hardover"  failures, 
can  result  in  drawing  excessive  current  from  the  power  source.  Therefore,  regardless  of  which  re¬ 
dundancy  method  is  selected,  "short  circuit"  protection  of  the  power  source  must  be  provided. 

This  protection  also  removes  power  from  a  failed  channel.  The  actual  redundancy  method  selected 
will  depend  on  the  system  application. 

This  system  approach  simplifies  the  actuation,  the  command  electronics,  and  the  interface  by  in¬ 
creasing  the  use  of  digital  electronics.  The  only  area  that  remains  analog  is  the  feedback  snesors.  A 
program  is  presently  underway  that  will  remove  the  analog  sensors  and  reduce  the  electronic  hazards 
such  as  EMI,  EMP,  lightning,  high  energy  radiation,  and  spurious  signals. 
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THE  HYDRA-OPTIC  FLIGHT  CONTROL  ACTUATION  SYSTEM  {HOFCAS) 

DEVELOPMENT  PROGRAM 


The  AFCAS  concept  developed  by  the  Naval  Air  Development  Center  (NADC)  is  a  direct-drive, 
lightweight,  hydraulic  surface  actuation  system  capable'of  being  controlled  with  a  direct  digital 
command.  This  Direct  Digital  Drive  (D3)  actuation  system  and  the  lightweight  hydraulics,  have 
been  successfully  flight  tested  and  shown  to  be  a  practical  approach  to  surface  actuation.  This 
project  utilizes  AFCAS  with  new  approaches  incorporated  to  eliminate  the  conventional  intercon¬ 
necting  cabling  to  the  surface  actuator. 

A  major  concern  for  future  fly-by-wire  aircraft  is  protection  against  electronic  hazards  such  as  EMI, 
EMP,  lightning,  high  energy  radiation,  and  spurious  signals.  If  control  signals  can  be  transmitted  via 
light  pulses,  particularly  to  the  actuation  regions,  then  electromagnetic  transient  protection  can  be 
greatly  enhanced.  By  removing  all  electrical  connections  to  the  actuator,  electromagnetic  coupling 
which  would  allow  RFI,  lightning  or  other  transient  signals  to  enter  would  be  eliminated.  The 
electrical  power  required  to  receive  and  utilize  the  light  pulses  would  be  generated  hydraulically 
within  the  actuator.  The  electronics  to  restore  the  digital  signal  and  drive  the  electrohydraulic  valve 
would  also  be  contained  within  or  on  the  actuator.  The  system  developed  for  this  project  offers  an 
approach  for  meeting  the  goal  of  a  direct  drive  surface  actuator  with  no  interconnecting  cabling. 

The  AFCAS  program  that  preceded  this  study  was  a  six  phase  program  that  explored  the  feasibility 
of  direct  drive,  developed  the  concept,  and  evaluated  it  in  a  series  of  laboratory  and  flight  test  pro¬ 
grams.  Phase  VI  of  this  program  incorporated  the  microcomputer  and  successfully  demonstrated 
the  D^  capability  of  the  AFCAS.  Pulse  modulated  signals,  generated  in  the  microcomputer,  were 
power  amplified  in  an  Electronic  Drive  Unit  (EDU)  and  used  to  control  the  direct  drive  actuator. 

An  analog  backup  capability  was  also  provided,  whereby  the  EDU  controlled  the  actuator  directly 
and  the  microcomputer  was  not  in  the  control  loop. 

The  general  objective  of  this  program  was  to  assemble  and  test  a  direct-drive,  lightweight,  hydraulic 
surface  actuator  system  that  provides  immunity  to  all  forms  of  electromagnetic  radiation.  The 
specific  goal  was  to  operate  the  digital  AFCAS  without  the  need  for  electrical  power  being  trans¬ 
mitted  to  the  actuator.  This  was  accomplished  by  modifying  the  AFCAS  to  operate  with  a 
hydraulically-driven  alternator  supplying  the  electrical  power,  and  adding  an  optical  command  link 
between  the  microcomputer  and  the  direct  drive  actuator  electronics. 

TECHNICAL  APPROACH 

The  technical  approach  used  to  develop  the  Hydra-Optic  Flin^t  Control  Actuation  System 
(HOFCAS)  was  to  utilize  assets  developed  under  the  previous  six-phase  AFCAS  program  and  to 
demonstrate,  through  laboratory  testing,  that  the  HOFCAS  concept  is  suitable  for  flight  in  the  T-2C 
Demonstrator  Aircraft.  The  AFCAS  actuator,  the  transducers,  and  the  microcomputer  power  sup¬ 
ply  were  used  without  change.  The  microcomputer  and  the  EDU  were  modified  to  incorporate 
optical  data  transmission.  A  Hydra-Powered  Alternator  (HPA)  was  added  to  supply  the  electrical 
power  needed  for  the  actuator  drive  unit.  Additional  changes  were  made  to  the  system  switching 
and  interconnecting  wiring  to  incorporate  the  new  modes  of  operation. 
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The  system  configuration  was  designed  and  tested  to  verify  that  the  HOFCAS  is  suitable  for  con¬ 
trolling  the  rudder  of  a  T-2C  aircraft,  shown  in  Figure  84.  For  this  application  the  T-2C  control 
system  will  be  modified  from  a  mechanically  powered  cable  system  to  a  full  powered  Digital  Fly- 
By-Light  (DFBL)  system  with  an  Analog  Back-Up  (ABU)  mode  of  operation.  The  original  cable 
system  between  the  rudder  pedals  and  the  rudder  will  be  removed.  The  rudder  pedal  will  be 
attached  to  force  transducers.  Force  on  the  rudder  pedal  is  converted  to  a  proportional  electrical 
signal  by  these  force  transducers.  This  signal  is  supplied  to  a  microcomputer  where  it  is  summed 
with  the  feedback  signal  and  processed  into  a  pulse  modulated  error  signal.  The  pulse  modulated 
error  signal  is  transmitted  optically  through  fiber  optic  cables  to  the  EDU  where  it  is  converted  to 
electrical  signals,  power  amplified,  and  used  to  control  the  torque  motor  of  a  direct  drive  hydrau¬ 
lic  rudder  actuator.  This  modified  system  provided  full  power  DFBL  control  of  the  rudder, 
instead  of  the  manually  operated  rudder  of  the  basic  T-2C  aircraft. 

The  HOFCAS  mounting  requirements,  lead  length,  and  hydraulic  and  electrical  power  sources 
were  selected  to  be  compatible  with  the  T-2C.  The  HOFCAS  evaluation  criteria  were  selected 
to  meet  the  dynamic  performance  requirement  of  the  T-2C  aircraft.  Safety  provisions,  including 
failure  mode  evaluation,  were  based  on  T-2C  flight  safety  requirements.  The  previous  AFCAS 
flight  test  program  included  a  hydraulic  bypass  valve  on  the  direct  drive  actuator.  This  device 
allows  the  rudder  to  seek  a  trail  position  if  the  rudder  control  system  were  lost.  Flight  testing 
has  established  the  aircraft  can  be  safely  landed  with  the  rudder  in  the  trail  position.  This  fea¬ 
ture  establishes  a  third  level  of  redundancy  beyond  the  DFBL  and  the  ABU  modes  of  control. 

All  the  major  components  needed  to  fly  the  HOFCAS  in  the  T-2C  were  assembled  in  the  labora¬ 
tory  for  the  system  testing.  System  and  component  tests  were  performed  to  insure  satisfactory 
operation  in  the  T-2C.  Additional  system  tests  were  performed  that  exceeded  T-2C  require¬ 
ments.  These  tests  were  performed  to  establish  the  performance  levels  possible  with  the  present 
HOFCAS  and  to  identify  areas  where  improvements  could  be  made  if  necessary. 

This  approach  makes  use  of  existing  Navy  hardware  to  test  and  evaluate  several  critical  portions 
of  an  actuation  system  that  eliminates  the  need  for  wiring  to  transmit  power  and  signal  to  the 
actuation  region.  The  Navy  currently  has  a  separate  program  for  developing  an  optical  position 
sensor  to  provide  a  feedback  for  this  direct  drive  hardware.  After  the  optical  sensor,  the  HPA, 
and  the  EDU  are  integrated  into  a  common  actuation  package  with  the  D^  actuator,  the  general 
objectives  of  this  program  will  be  achieved. 

DESCRIPTION  OF  THE  HOFCAS 

The  HOFCAS  utilizes  a  direct  drive  actuation  system,  commanded  by  light,  with  self  contained 
electrical  power  to  control  an  aircraft  rudder  actuation  system.  The  system  hardware  for  this  pro¬ 
gram  is  a  modification  of  the  Phase  VI  Direct  Digital  Drive  AFCAS  program  hardware  previously 
evaluated  and  described  in  Reference  17. 

A  simplified  block  diagram  showing  the  major  components  of  the  HOFCAS  system  is  contained  in 
Figure  101 .  The  shaded  areas  in  Figure  101  indicate  the  units  modified  or  added  for  the  HOFCAS. 
The  microcomputer  and  the  EDU  were  modified  to  incorporate  the  optical  command  link  (new) 
and  the  HOFCAS  Hydra-Powered  Alternator  (HPA)  is  a  new  unit  added  to  provide  electrical  power 
for  the  EDU  in  the  Digital  Fly-By-Light  (DFBL)  mode.  Two  modes  of  system  operation  are  pro¬ 
vided,  the  DFBL  and  the  ABU  modes.  Figure  102  contains  a  block  diagram  that  illustrates  the  two 
modes  of  operation. 
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Figure  102.  HOFCAS  Operational  Modes,  Simplified  Block  Diagram 
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The  DFBL  mode  is  selected  by  momentarily  holding  the  cockpit  DFBL  ENGAGE  switch  to  ON, 
energizing  the  DFBL  control  relays  and  resulting  in  the  following: 

•  The  pedal  command  and  actuator  feedback  transducer  outputs  are  connected  to  the 
microcomputer  input. 

•  The  microcomputer  output  is  connected  to  the  EDU  via  the  fiber  optic  control  link. 

•  Hydraulic  pressure  is  supplied  to  the  HOFCAS  HPA,  and  the  26  VAC,  1000  Hz  HPA 
output  is  used  to  power  the  EDU  via  a  26  VAC  to  1 15  VAC  step-up  transformer.  The 
EDU  input  power  is  utilized  to  provide  excitation  for  the  transducers  and  to  condition, 
amplify,  and  convert  the  optical  signals  into  electrical  signals  which  are  power  amplified 
and  used  to  drive  the  torque  motor  coils. 

If  the  microcomputer  senses  the  system  is  functioning  properly,  a  power  ground  is  continuously 
supplied  to  the  DFBL  ENGAGE  switch  holding  coil  by  the  microcomputer  and  the  system  remains 
in  the  DFBL  mode. 

The  ABU  mode  can  be  selected  by  manually  placing  the  DFBL  ENGAGE  switch  to  OFF,  or  auto¬ 
matically  by  the  microcomputer  removing  the  power  ground  from  the  DFBL  ENGAGE  switch  hold¬ 
ing  coil  if  abnormal  system  operating  errors  occur. 

Switching  to  the  ABU  mode  results  in  the  following: 

•  The  fiber  optic  control  link  output  from  the  microcomputer  is  disconnected  from  the 
EDU,  and  the  pedal  command  and  actuator  feedback  transducer  outputs  are  connected 
directly  to  the  EDU  where  they  are  summed  and  amplified  to  drive  the  four  torque  motor 
coils  of  the  actuator  direct  drive  valve. 

•  Hydraulic  pressure  is  removed  from  the  HOFCAS  HPA,  and  the  EDU  is  powered  by 
1 15  VAC,  400  Hz  aircraft  power. 

The  various  system  components  are  discussed  in  the  following  paragraphs. 

1.  Hydra-Powered  Alternator  (HPA) 

The  HOFCAS  HPA  assembly,  Bertea  P/N  287700,  supplies  electrical  power  to  the  EDU  in 
the  DFBL  mode.  The  alternator  rated  output,  at  3000  psi  (21  MPa)  A  P  and  a  fluid  flow 
of  0.72  gpm  (2.7  L/min),  is  25  watts  @  26  VAC,  1000  Hz.  The  HPA  was  not  used  in  the 
previous  Phase  VI  of  the  Digital  AFCAS  program  and  has  been  added  for  HOCFAS. 

The  unit  consists  of  a  hydraulically  driven  2"  (5.1  cm)  diameter  turbine  wheel  coupled 
to  a  conventional  permanent  magnet  electric  alternator,  spun  by  fluid  discharged  from  a 
.020"  (.05  cm)  diameter  orifice.  The  6-pole  configuration  of  the  alternator,  Electro- 
Kinetics  Model  No.  4922-2,  provides  a  frequency  of  1000  Hz  at  10,000  rpm. 

The  alternator  output  is  nearly  sinusoidal  with  a  resistance  load,  and  distorts  to  a  pseudo 
square  wave  when  inductive  loads  are  applied,  (detailed  data  describing  alternator  output 
and  waveforms  are  contained  in  section  3.3.1  of  Reference  19). 
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The  HPA  turbine  wheel  and  alternator  are  shown  in  Figure  103  and  the  HPA  assembly  is 
shown  in  Figure  104.  Additional  HPA  data  is  supplied  in  Appendix  B  of  Reference  19. 

2.  Electronic  Drive  Unit  (EDU) 


The  EDU  contains  the  electronics  required  for  converting  optical  inputs  to  electrical  in¬ 
put  signals,  signal  conditioning  and  amplification,  signal  summation,  and  power  amplifi¬ 
cation  to  current  drive  the  actuator  torque  motor.  The  unit  was  designed  by  the  North 
American  Aircraft  Division  (NAAD)  and  contains  two  independent  channels,  each  sub¬ 
divided  into  dual  valve  driver  circuits. 

Each  of  the  dual  valve  driver  circuits  employ  current  feedback  with  a  highly  reliable 
"Darlington"  power  transistor  configuration.  Redundant  power  supplies  are  used.  The 
circuitry  is  designed  so  that  in  the  event  an  output  stage  fails  "hardover",  the  voltage  ap¬ 
plied  to  a  motor  coil  will  not  exceed  its  rated  value.  This  limiting  feature  permits  a  sub¬ 
unit  failure  to  be  compensated  or  nullified  by  another  subunit.  Closed  loop  tests  showed 
that  operation  of  the  redundant  subunits  provided  high  immunity  to  component  failures. 

The  dual  channel  fiber  optic  receiver  amplifier  added  for  HOFCAS  converts  the  micro¬ 
computer  optical  output  signals  to  electrical  input  signals  for  the  EDU.  Each  receiver 
amplifier  channel  contains  a  detector,  two  stages  of  gain,  and  a  passive  isolation  circuit. 
The  optical  signals  received  consist  of  PWM  information,  and  the  passive  isolation  feature 
prevents  a  hardover  of  the  rudder  actuator  if  the  drive  signal  is  lost  due  to  a  microcom¬ 
puter  or  fiber  optic  loop  failure. 

The  dual  channel  fiber  optic  receiver  amplifier  and  associated  detectors  are  located  on  a 
single  module  board,  contained  in  a  housing  mounted  on  the  EDU.  All  electrical  and 
optical  connections  to  the  module  board  were  made  to  permit  easy  removal  if  return  of 
the  EDU  to  its  original  configuration  is  desired. 

The  modified  EDU  with  fiber  optic  cables  is  depicted  in  Figure  105  and  is  functional 
schematic,  including  the  fiber  optic  receiver  amplifier,  is  included  in  Figure  2-3  of 
Reference  19. 

3.  Microcomputer  Assembly  and  Power  Supply 


The  microcomputer  assembly  is  housed  in  an  enclosed  unit,  and  consists  of  the  following 
subassemblies: 

•  Motorola  Monoboard  Microcomputer  Module 

•  Analog-To-Digital  (A/D)  Converter  Module 

•  Digital-To-Analog  (D/A)  Converter  Module 

•  Card  Cage  and  Mother  Board  Assembly 

•  Signal  Conditioning  Board 

•  Fiber  Optics  Transmitter  Board  Assembly 

The  microcomputer  module  is  a  complete  computer-on-a-board  having  ail  the  process¬ 
ing  and  control  required  for  a  microcomputer-based  system.  It  incorporates  the  MC 
6800  MPU,  1  K  of  Random  Access  Memory  (RAM),  provisions  for  4  K  of  Programmable 
Read  Only  Memory  (PROM),  timing  and  control,  buffers,  an  Asychronous  Interface 
Adapter  (ACIA)  and  two  Peripheral  Interface  Adapters  (PIA). 
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The  A/D  converter  module  consists  of  eight  channels  of  A/D  conversion  of  which  four 
are  utilized.  The  D/A  converter  module  consists  of  four  channels  of  D/A  conversion  of 
which  three  are  utilized. 

The  signal  conditioning  board  contains  four  channels  of  sensor  signal  conditioning  and 
a  relay  driver  that  interfaces  the  microcomputer  monitor  output  with  the  system  con¬ 
trol  logic. 

The  dual  channel  fiber  optic  transmitter  board  was  added  for  HOFCAS.  Located  in 
the  microcomputer  housing,  the  board  contains  a  fiber  optic  photo  diode  and  dropping 
resistor  for  each  channel,  to  convert  the  microcomputer  PWM  output  to  optical  form  for 
transmission  to  the  EDU.  Two  fiber  optic  cables,  each  10  feet  (3.05  m)  long,  intercon¬ 
nect  the  microcomputer  and  EDU.  The  10  foot  (3.05  m)  cables  simulate  the  length 
required  to  connect  an  actuator,  with  its  electronic  EDU  Located  at  the  rudder,  to  the 
microcomputer  located  in  the  equipment  bay.  The  microcomputer  unit  with  the  fiber 
optic  cables  attached  is  shown  in  Figure  106. 

A  separate  power  supply  (Motorola  P/N  M68MMPS1)  is  provided  to  supply  power  to 
the  microcomputer.  The  power  supply  converts  single-phase,  115  VAC,  400  Hz  to  +  5 
VDC  and  ±12  VDC. 

Additional  information  on  the  microcomputer  is  contained  in  Appendix  A  of  Reference 
19. 

The  software  of  the  microcomputer  is  the  same  as  that  used  in  the  flight  testing  of  the 
D^  AFCAS  concept  (Reference  (7). 


Laboratory  tests  were  accomplished  to  integrate  the  HOFCAS  with  the  existing  Phase  VI  digital 
AFCAS  system,  perform  system  functional  tests,  evaluate  system  performance  and  compatibility 
with  the  HOFCAS  modification,  and  to  determine  the  effects  of  the  HOFCAS  modification  on 
system  performance.  Temperature  tests  were  also  performed  to  verify  the  equipment  would  func 
tion  properly  in  the  T-2C  aircraft  operating  environment. 


Laboratory  tests  were  accomplished  using  the  actual  aircraft  components  to  simulate  flight  con¬ 
ditions  in  preparation  for  flight  testing  of  the  system  at  a  later  date. 
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Included  in  the  lab  setup  were  the  rudder  LVDT  feedback  transducers,  rudder  actuator,  EDU, 
microcomputer  and  associated  power  supply,  HPA,  fiber  optic  link  including  emitters,  detectors 
and  fiber  optic  cables,  and  the  switches  and  control  relays  used  in  the  aircraft. 

The  lab  wire  harness  was  configured  to  simulate  the  aircraft  wiring,  and  a  terminal  strip/intercon¬ 
nection  board  provided  control,  test  points,  and  the  interface  between  the  wire  harness,  system 
components,  and  lab  test  equipment.  The  Lab  Signal  Simulator  Box  was  included  as  part  of  the  lab 
test  setup,  and  provided  simulated  pedal  force  commands,  LVDT  feedback  signals,  and  microcom¬ 
puter  PWM  output  signals  during  certain  phases  of  system  testing.  The  two  fiber  optic  cables,  con¬ 
necting  the  microcomputer  output  to  the  EDU,  were  each  10  feet  (3.05  m)  in  length  simulating  the 
actual  aircraft  cable  length  requirements.  A  portable  lab  hydraulic  pressure  source  was  used  for  all 
lab  testing. 

The  bandpass  requirements  and  therefore  the  system  loop  gain  were  established  by  T-2C  aircraft 
dynamic  requirements  for  the  integration  tests.  System  dynamic  response  tests  were  performed  to 
demonstrate  that  the  HOFCAS  operational  modes  meet  these  dynamic  requirements  and  are  satis¬ 
factory  for  controlling  the  rudder  of  the  T -2C  aircraft.  The  lab  test  setup  was  configured  to  pro¬ 
vide  either  HPA  1000  HZ  or  simulated  aircraft  400  HZ  power  for  the  EDU  in  the  HOFCAS  DFBL 
and  ABU  modes,  and  a  DFBW  mode  of  operation.  A  function  generator  provided  sinusoidal  and 
step  input  signals  to  the  system  force  transducer  inputs  and  a  2-channel  strip  chart  recorder  was 
used  to  record  the  function  generator  output  and  rudder  actuator  feedback  signal. 

ANALYSIS  OF  TEST  RESULTS 

The  test  results  demonstrate  that  the  HOFCAS  is  satisfactory  for  operation  in  the  rudder  system 
of  the  T-2C  aircraft.  The  testing  was  divided  into  three  categories.  The  first  group  of  tests  accom¬ 
plished  the  functional  testing  of  the  added  system  components,  especially  the  HPA.  The  second 
group  of  tests  evaluated  the  HOFCAS  for  operation  with  the  T-2C  rudder.  The  third  set  of  tests 
established  performance  limits  and  provided  data  for  suggested  improvements  in  the  HOFCAS 
concept. 

1.  Hydra-Powered  Alternator  (HPA) 

The  functional  tests  established  the  HPA  operational  capability  and  demonstrated  the 
unit  is  adequate  to  supply  the  electrical  power  needed  to  operate  the  rudder  actuator  of 
a  T-2C  aircraft.  The  data  obtained  has  the  characteristics  expected  for  the  HPA  design. 
The  design  is  described  in  Appendix  B  of  Reference  19. 

The  speed  (frequency)  and  the  no  load  voltage  of  the  alternator  are  directly  related  to 
hydraulic  flow,  which  is  controlled  by  the  turbine  nozzle  diameter  and  the  applied 
hydraulic  pressure.  Increased  flow  through  the  fixed  nozzle  results  in  increased  losses 
and  additional  heating  of  the  hydraulic  fluid. 

The  alternator  used  for  this  project  was  an  adaptation  of  an  existing  missile  power 
source  and  is  wound  to  provide  alternator  protection  against  overloads.  This  charac¬ 
teristic  becomes  apparent  in  the  tests  data.  As  the  output  current  is  increased,  the 
voltage  decreases  and  total  power  output  remains  the  same.  At  the  same  time,  the 
unit  shows  very  little  change  in  speed  (frequency)  with  increased  current.  As  the 
power  output  remains  constant  at  rated  load,  it  is  apparent  the  hydraulic  turbine  load 
is  constant  and  the  speed  would  not  vary.  In  addition,  the  HPA  has  a  very  low  effi¬ 
ciency  so  that  slight  variations  in  extracted  power  have  very  little  effect  on  total 
torque  required  to  drive  the  alternator. 
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Wave  shapes  of  the  alternator  output  showed  the  waveform  with  a  resistive  load  to  be 
nearly  sinusoidal.  For  this  system  application  the  output  power  is  supplied  to  power 
supplies  in  the  EDU  through  a  transformer  and  the  wave  shape  is  not  critical  to  system 
operation.  When  the  HPA  was  used  to  power  the  EDU,  the  load  became  highly  induc¬ 
tive  and  the  wave  shape  approached  a  square  wave.  While  this  does  not  directly  affect 
system  operation,  the  distorted  wave  shape  reduces  transformer  and  power  supply  effi¬ 
ciencies  and  further  increases  the  loading  effects  on  the  alternator. 

The  HPA  used  for  this  project  is  satisfactory  for  flight  testing,  and  will  demonstrate  the 
concept  of  a  actuation  system  without  electrical  power  and  signals  routed  to  the 
actuation  surface.  Several  areas  of  improvement  in  the  HPA  performance  are  desirable 
and  are  discussed  in  Appendix  B  of  Reference  19. 

2.  Fiber  Optic  Link 

The  fiber  optic  link  performed  satisfactorily  as  expected.  No  difference  in  system  per¬ 
formance  was  noted  between  the  fiber  optic  link  or  direct  wiring  method  of  connecting 
the  microcomputer  output  to  the  EDU. 

3.  Flight  Test  Configuration 

HOFCAS  integration  tests  were  performed  using  the  hardware  configured  to  the  T-2C 
aircraft  installation.  These  tests  consisted  primarily  of  dynamic  response  and  failure 
mode  evaluation.  Frequency  response  tests  showed  a  slight  reduction  in  system  perform¬ 
ance  with  the  EDU  powered  by  the  HPA  1000  Hz  output  compared  to  4C>0  Hz  power. 

The  slight  reduction  in  dynamic  response,  when  the  EDU  is  powered  by  the  HPA  1000 
HZ  output,  is  due  to  the  limited  power  capability  of  the  HPA  which  results  in  a  voltage 
drop  at  the  torque  motor  coils  when  additional  power  is  requested.  The  voltage  drop 
causes  a  reduction  in  loop  gain  and  a  corresponding  loss  of  bandpass. 

The  HPA  used  in  this  project  is  capable  of  a  steady  state  26  watt  output  with  no  capa¬ 
bility  of  handling  higher  power  demand  transients.  The  EDU  peak  power  requirement 
is  50  watts,  consisting  of  32  watts  for  the  torque  motor  and  18  watts  for  EDU  amplifiers, 
power  supplies,  and  transducer  excitation.  The  torque  motor  characteristics  (see  Figure 
107)  are  such  that  at  26  watts  total  power  (8  watts  at  the  torque  motor)  the  major  por¬ 
tion  of  the  spool  travel  has  occurred  and  the  rated  flow  of  the  valve  is  already  obtained. 

The  additional  power  requirement  to  the  torque  motor  is  needed  to  obtain  the  full 
particle  shear  out  capability  and  is  not  required  for  full  hydraulic  flow.  For  the  T-2C 
application,  if  the  full  torque  motor  force  is  required,  the  system  will  revert  to  the  ABU 
mode  with  aircraft  power  and  full  shear  force  will  be  available. 

The  step  response  characteristics  determined  during  the  tests  again  show  the  effects  of 
limited  power  to  the  EDU.  This  effect  is  more  pronounced  with  step  demands  as  they 
require  high  power  peaks. 

4.  HOFCAS  Performance 

Results  of  the  dynamic  tests  performed  in  this  project  successfully  demonstrated  the 
suitability  for  HOFCAS  operation  in  a  T-2C  aircraft  and  provided  additional  data  to 
demonstrate  the  potential  of  a  HOFCAS  design. 

The  performance  of  the  AFCAS  actuator  was  evaluated  in  a  previous  flight  test  pro¬ 
gram.  The  measured  frequency  response  shown  in  Figure  108  is  approximately  13 
Hz.  This  response  was  considerably  above  that  required  for  the  flight  test  program. 
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Figure  107.  Torque  Motor  Characteristics 

The  operation  of  this  actuator  used  the  same  analog  EDU  to  drive  the  torque  motor 
of  the  actuator.  Since  the  EDU  was  not  optimized  for  digital  drive  some  bandpass  was 
lost,  and  the  response  is  that  shown  on  Figure  109  for  aircraft  power.  Rockwell  lab¬ 
oratory  tests  of  a  circuit  optimized  for  direct  digital  drive  have  produced  the  frequency 
response  (25  Hz)  shown  in  Figure  1 10.  As  the  natural  frequency  of  the  torque  motor 
is  approximately  230  Hz,  the  dynamic  response  is  limited  either  by  the  valve  design  or 
the  electronic  drive  design. 

The  data  of  Figure  109  shows  the  dynamic  response  obtained  with  the  present 
design  and  that  obtained  with  the  HOFCAS  design.  As  mentioned  above  the  bandpass 
with  aircraft  power  matches  that  of  Phase  VI  of  the  AFCAS  program.  The  reduced 
response  of  the  HOFCAS  design  is  produced  by  the  limited  power  available  from  the 
HPA.  The  limited  HPA  power  reduces  the  power  available  to  the  torque  motor  coils 
resulting  in  a  reduced  loop  gain  under  dynamic  conditions.  This  produces  reduced 
response  but  no  decrease  in  static  accuracy. 

For  comparison  purposes  the  response  curve  of  the  ABU  mode  is  shown  in  Figure 
111.  This  response  is  the  same  as  that  of  the  two  previous  flight  test  programs  and 
demonstrates  that  the  modifications  for  HOFCAS  did  not  affect  the  ABU  operation. 

RECOMMENDATIONS 

The  results  of  the  laboratory  tests  demonstrate  that  the  HOFCAS  configuration  is  satisfactory  for 
flight  testing  in  a  T-2C  aircraft.  The  tests  prove  the  HOFCAS  concept  is  a  practical  approach  for 
operating  remotely  located  surface  actuation  with  immunity  to  electromagnetic  interference.  The 
D^  actuator  is  ideally  suited  for  this  application  because  of  the  integrated  actuator  concept  and 
the  ease  of  adapting  optical  control  the  actuator. 
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The  next  logical  step  in  developing  the  HOFCAS  would  be  to  demonstrate  the  concept  in  flight. 
Several  additional  developments,  some  of  which  are  already  in  work,  are  needed  to  establish  this 
concept  for  use  in  future  high  performance  aircraft.  These  items  are: 

•  A  suitable  optical  actuator  feedback  link. 

•  High  temperature  digital  electronics  suitable  for  packaging  inside  the  actuator. 

•  An  improved  rotary  type  valve-torque  motor  suitable  for  packaging  inside  the 
actuator. 

•  An  improved  HPA  with  the  capability  of  handling  the  peak  transient  power 
requirements. 

•  Design  of  the  integrated  actuator  package. 

The  optical  feedback  link  and  the  valve-torque  motor  are  already  under  development  in  separate 
Navy  programs.  The  drive  electronics  would  be  the  next  needed  development.  The  new  electronics 
and  the  improved  valve-torque  motor  can  be  expected  to  reduce  the  power  requirements  of  the 
HPA. 

Other  studies  of  interest  would  include  research  into  methods  of  improving  the  HPA  efficiency 
without  increased  size,  weight  or  complexity.  A  design  study  to  show  the  advantages  of  the 
HPA  over  the  "brute  force"  approach  (shielding,  filtering,  etc.)  to  protect  against  EMP  would 
also  be  desirable. 

The  conclusions  of  this  study  show  that  HOFCAS  approach  incorporating  a  actuation  sys¬ 
tem  will  produce  a  simple  highly  reliable  actuation  system  that  is  immune  to  the  effects  of 
electromagnetic  interference. 

Figure  112  shows  an  actuator  concept  in  which  the  digital  electronics,  rotary  value  torque 
motor,  and  feedback  transducers  are  integrated  inside  the  actuator  body. 

INI  ERFACE  OF  FLIGHT  CONTROL  COMPUTER  COMPLEX,  d3  ACTUATION, 

AND  HOFCAS 

The  HOFCAS  could  be  configured  for  either  three  or  four  channel  redundancy.  With  the  improve¬ 
ments  in  digital  technology  and  self  monitoring  techniques,  it  is  anticipated  that  future  systems 
will  be  triplex.  A  triplex  redundancy  concept  for  HOFCAS  is  illustrated  in  Figure  113. 

The  force  motors  will  be  designed  with  three  windings  per  motor  and  will  use  a  switching  ampli¬ 
fier  for  each  coil.  This  redundancy  level  will  remove  the  need  to  disconnect  a  failed  unit.  Short 
circuit  protection  will  be  included  at  all  six  switching  amplifiers.  The  amplifier  is  commanded 
with  a  PWM  signal.  The  optical  sensors  are  designed  to  supply  a  digital  feedback  signal  to  the 
computer.  This  system  produces  an  actuation  loop  that  is  completely  digitally  controlled.  The 
removal  of  interconnecting  wires  between  the  computer  and  the  actuator  will  greatly  reduce  the 
susceptibility  to  electromagnetic  interference.  This  system  is  still  in  the  early  stages  of  develop¬ 
ment  and  the  redundancy  concepts  may  be  modified  as  additional  test  data  is  obtained  on  system 
components. 
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Figure  112.  HOFCAS  System  Redundancy  Concept 
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Figure  1 13.  HOFCAS  System  Redundancy  Concept 
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FAULT-TOLERANT  ACTUATION  CONCEPT  FOR  A  RESEARCH  TEST  Al  RCRAFT 


BACKGROUND  INFORMATION 

Current  hovering  aircraft  capabilities  demand  considerable  visual  contact  flight  before  final  landing, 
with  the  pilot  providing  most  of  the  attitude-stabilizing,  position-fixing,  height-controlling  and  deck 
motion  compensating  functions.  Pilot  workload,  even  in  clear  weather  operations,  is  excessive. 

This  places  additional  demands  of  considerable  magnitude  upon  the  pilot  and  the  flight  control 
capabilities  of  the  hovering  vehicle.  The  development  of  an  advanced,  precise,  and  highly  reliable 
flight  control/guidance  system  concept  to  meet  operational  goals  is  a  prime  requirement.  The  man¬ 
ual  and  automatic  modes  of  the  flight  control  system  must  have  sufficient  authority  to  perform 
their  required  functions  during  the  critical  vertical  take-off  and  landing  operations.  This  implies 
that  the  conflict  between  automatic  control  authority  and  flight  safety  must  be  resolved  by  incorpo¬ 
rating  fail-safe  and  fault- tolerant  features  in  the  Flight  Control  System  (FCS). 

The  study  vehicle  selected  for  the  integration  and  evaluation  of  the  4-valve  fault-tolerant  actuation 
concept,  developed  by  Bell  Helicopter  Textron  Corporation,  is  a  helicopter  with  a  Type  II  power 
boosted  FCS.  The  Type  II  FCS  is  a  reversible  control  system  wherein  the  pilot  effort,  which  is 
exerted  through  a  set  of  mechanical  linkages,  is  at  some  point  in  these  linkages  boosted  by  a  power 
source,  which  in  this  application  is  hydraulic.  Flight  control  commands  from  the  pilot  and  the 
Automatic  Flight  Control  System  (AFCS)  are  algebraically  summed  and  then  transmitted  to  the 
flight  control  surfaces. 

Automatic  landing  capability  is  h.._  <y  desired,  which  in  turn  dictates  a  large  control  power  require¬ 
ment.  Therefore,  the  AFCS  is  anticipated  to  be  a  high  (50  percent)  authority  system.  During  auto¬ 
matic  landings  on  small  ships,  all  ship  kinematics,  aircraft  range,  and  range  rate  information  will  be 
transmitted  to  the  helicopter  via  the  Landing  Guidance  Sensor  (LGS)  data  link.  All  computations 
of  the  flight  control  laws  required  for  execution  of  the  landing  task  will  be  performed  by  the  Flight 
Control  Computers  (FCC)  which  will  then  transmit  the  appropriate  commands  to  the  flight  control 
surfaces  via  the  4-valve  fault  tolerant  AFCS  actuator. 

The  actuation  system  for  the  AFCS  is  recognized  as  a  critical  technology  in  the  development  of  a 
research  flight  test  vehicle.  It  is  for  a  dual  fail-operate  requirement  that  the  4-valve  actuation  system 
is  designed. 

FLIGHT  CONTROL  ACTUATOR  REQUIREMENTS 

In  order  to  resolve  the  conflict  between  automatic  control  authority  and  flight  safety  the  laboratory 
versions  of  the  4-valve  AFCS  and  the  primary  boost  actuators  were  required  to  have  the  following 
design  features  and  capabilities: 

(a)  The  hydraulic  and  electrical  power  supplies  shall  be  configured  to  provide  a  Failure  Tolerance 
Level  (FTL)  of  single-fail/operate  for  the  primary  actuators  as  well  as  for  the  AFCS  series 
hydraulic  actuators. 
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(b)  The  AFCS  series  actuators  shall  incorporate  the  following  features: 

(1)  Be  dualized  and  include  a  feature  that  automatically  centers  and  mechanically  locks 
the  piston  shaft  when  the  AFCS  is  disengaged  or  in  the  event  all  hydraulic  or  all  elec¬ 
trical  power  is  lost.  The  centering  function  shall  center  the  series  actuators  at  a  rate 
that  shall  not  overburden  or  disorient  the  pilot. 

(2)  Be  interfaced  with  the  primary  boost  actuators  in  such  a  manner  that  full  manual  re¬ 
version  capability  is  provided  in  the  event  all  hydraulic  power  is  lost. 

(3)  Operate  in  conjunction  with  parallel  trim  actuators  in  such  a  manner  that  they  shall 
normally  be  working  about  the  center  point  of  authority. 

(4)  Be  capable  of  receiving  triplex  electrical  command  signals  from  the  AFCS  and  adding 
them  algebraically  to  the  pilot's  mechanical  input 

(5)  Possess  at  least  a  single-fail/operate  capability  with  inherent  fault-tolerant  features. 

(6)  Provide  50%  of  the  total  (stop  to  stop)  command  authority  for  the  triplex  electrical 
signals  from  the  AFCS. 

(7)  Contain  provisions  to  disengage  the  triplex  electrical  signals.  Disengagement  will  not 
effect  a  transient  that  could  be  considered  hazardous. 

(8)  Be  powered  by  two  independent  1,000  psi  hydraulic  systems. 

(9)  Be  installed  so  that  triplex  signals  shall  not  be  reflected  back  to  the  pilot's  cockpit 
input  device  unless  the  summed  input  from  the  pilot  and  series  actuator  is  in  excess  of 
the  total  allowable  control  travel. 

(10)  Simultaneous  application,  of  large  pilot  AFCS  electrical  inputs  shall  not  overload  the 
output  mechanical  devices  downstream  of  the  actuator  (stops  downstream  of  the 
summed  output).  "Smart"  constraints  for  structural  protection  should  be  considered. 

(11)  Be  efficiently  packaged  for  installation  in  confined  areas. 

INTERFACE  OF  THE  PRIMARY  AND  AFCS  ACTUATORS 

The  actuator  configurations  shown  in  Figures  1 14  and  115  functionally  describe  two  concepts  on 
how  the  4-valve  AFCS  actuator  can  be  operationally  interfaced  with  the  primary  boost  actuators  to 
effect  a  series- type  control  input 

The  configuration  shown  in  Figure  1 14  uses  two  grounded-base  actuators  with  the  two  outputs  dif¬ 
ferentially  summed  at  a  specific  ratio  to  establish  the  desired  AFCS  authority.  Stops  are  located 
downstream  of  the  summing  to  limit  total  travel  of  the  controlled  output  and  hence  to  prevent  over¬ 
travel  of  the  basic  controlled  element  The  AFCS  actuator  is  dualized  and  uses  4-position  feedback 
sensors,  a  centering  spring/lock  mechanism,  and  4  electrohydraulic  servo  valves  (EHSV)  that  are 
controlled  by  quad-redundant  control  paths.  The  quad-redundant  electronics  can  be  interfaced  with 
digital  or  other  analog  systems. 
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Figure  114.  Output  Summing  Attached  Actuators  Configuration 


Figure  115.  Input  Summing  Attached  Actuators  Configuration 
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Operationally  the  configuration  shown  in  Figure  1 15  is  the  same  as  the  Figure  1 14  configuration 
with  the  exception  that  the  output  of  the  AFCS  actuator  is  mixed  with  the  pilot's  input  to  effect 
a  differentially-summed  output  to  the  control  valve  for  the  primary  actuator.  This  configuration 
uses  the  primary  actuator  for  the  muscle  which  allows  the  summing  to  be  accomplished  at  a  lower 
force  level.  Hence,  a  smaller  actuator  can  be  used.  The  centering  spring/lock  mechanism,  however, 
will  be  required  to  have  the  force  capability  of  centering  in  the  event  of  a  total  loss  of  hydraulic 
power.  Bell  Helicopter  Textron  (BHT)  has  used  an  actuator  configuration  of  this  type  in  a  3-axis 
SCAS  for  the  JetRanger  helicopter. 

This  configuration  was  selected  for  laboratory  because  it  offers  a  weight  and  size  advantage  as  well 
as  a  comparatively  low  hydraulic  flow  requirement 

THE  BELL  HELICOPTER  TEXTRON  FOUR-VALVE,  DIRECT  DRIVE,  ACTUATION  CONCEPT 

This  actuation  concept  was  originally  developed  by  the  BHT  Corporation  for  use  in  4-channel  heli¬ 
copter  FBW  control  systems.  It  does  not  require  the  use  of  secondary  actuators  and  its  4-valve  con¬ 
figuration  enables  it  to  be  hignly  fault  tolerant  The  4-valve  concept  has  high  hinge  moment  and 
stiffness  capabilities  and  can  be  used  to  actuate  large  swash  plates  and  conventional  flight  control 
surfaces.  It  is  readily  adaptable  for  use  in  high  performance  fixed  wing  aircraft. 

In  this  program  for  the  development  of  a  fault-tolerant  actuation  concept  for  a  test  aircraft  the  4- 
valve  concept  will  be  used  only  for  adding  AFCS  signals  to  those  of  the  pilot's.  It  was  chosen  for 
this  flight  safety  critical  task  because  of  its  fault-tolerant  features  and  high  inherent  reliability. 
Therefore,  its  force  output  requirement  for  this  application  is  very  low,  being  required  only  to 
actuate  the  boost  valve  of  the  primary  boost  actuator  (see  Figure  115). 

1.  Summarized  Description  of  Concept 

The  basic  fault-tolerant  actuation  system  consists  of  dual  hydraulic  primary  actuators,  quadruplex 
electrical  control  paths,  a  failure  management  system,  and  electrical  drive  signals.  Two  electrical 
control  paths  are  used  for  each  piston.  The  failure  management  system  is  mechanically  interfaced 
with  the  electrical  control  paths  to  provide  maximum  security.  It  provides  automatic  disengagement 
of  a  control  path  and  also  provides  track  error  signals  that  are  used  in  the  control  paths  for  auto¬ 
matic  alignment  of  the  four  valves. 

A  flight  test  model  of  this  system  would  include  a  master  control  panel  and  an  annunciator  panel. 
The  control  panel  would  provide  the  necessary  control  functions,  preflight  checkout  capability,  and 
a  manual  reset  for  each  control  channel.  The  annunciator  panel  would  indicate  the  operating  con¬ 
dition  of  the  control  paths  and  would  operate  in  conjunction  with  the  control  panel  for  the  pre¬ 
flight  checkout. 

2.  FBW  Control  Paths 

A  control  axis  of  the  basic  4-valve  actuation  concept  consists  of  four  FBW  control  paths  and  a  dual 
piston  power  cylinder.  The  four  control  paths  connect  the  pilot's  control  input  to  the  power  act¬ 
uator  cylinder  and  include  the  four  electrohydraulic  servovalves  as  shown  in  Figure  1 16. 

The  dual  actuator  schematically  depicted  is  conventional,  except  that  the  control  head  (spool  valve 
assembly)  has  been  replaced  with  the  four  electrohydraulic  servovalves. 
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Figure  1 16  is  a  functional  schematic  of  the  follow-up  system;  i.e.,  the  dual  actuator  is  slaved  to  the 
control  inputs.  All  control  paths  are  identical  and  operate  simultaneously.  A  control  input  to  the 
amplifiers  proportionally  opens  the  valves  and  drives  the  actuator  until  the  dual  feedback  trans¬ 
ducers  provide  feedback  signals  that  cancel  the  command  signals  at  the  amplifer,  which  closes  the 
valves  and  hence  stops  the  actuator  at  a  new  position.  The  four  valves  are  continuously  and  auto¬ 
matically  aligned  by  a  limited  authority  signal  that  is  inherent  in  the  failure  management  system 
(this  feature  is  discussed  in  more  detail  later).  The  dual  feedback  transducers  can  be  single  elements 
and  separately  located  to  reduce  vulnerability  to  battle  damage  if  desired.  The  response  of  the 
actuator  can  be  shaped  to  improve  handling  qualities  as  required. 

The  failure  logic  for  the  system  shown  in  Figure  116  operates  in  the  following  manner.  If  a  control 
path  fails  (e.g.,  path  la),  the  path  is  automatically  disengaged  and  Valve  la  is  cut  off  to  prevent 
leakage  of  fluid  from  one  side  of  the  piston  to  the  other.  A  second  path  failure  will  be  disengaged 
in  the  same  manner.  If  the  second  failure  should  be  path  1b,  the  logic  circuitry  will  automatically 
engage  a  pressure-operated  hydraulic  bypass  across  the  common  piston  so  that  the  failure  will  not 
restrict  the  operation  of  the  other  piston.  It  is  pointed  out  that  if  a  first  failure  should  disable  the 
failure  management  system  (described  in  the  next  section),  the  control  path  system,  shown  in  Figure 
116,  has  the  inherent  capability  of  absorbing  a  second  failure.  This  is  possible  because,  for  example, 
if  Valve  la  should  fail  and  remain  hardover,  the  other  three  valves  will  go  in  the  opposite  direction 
to  oppose  the  actuator  motion.  This  will  effect  a  bypass  around  the  piston  common  to  Valves  la 
and  1b  and,  hence,  will  allow  the  other  piston  to  operate  without  any  appreciable  degradation. 

This  inherent  feature  appreciably  improves  the  overall  reliability  of  the  system  and  allows  a  com¬ 
paratively  simple  failure  management  system  to  be  used  in  place  of  a  conventional  voting  scheme. 

The  overall  actuation  system  can  be  characterized  as  a  forgiving  type  system. 

3.  Failure  Management  System 

The  failure  management  system  is  an  integral  part  of  the  total  system.  It  is  required,  as  a  minimum, 
to  manage  only  one  failure  since  the  basic  FBW  system  has  an  inherent  failure  tolerance  level  of 
single-fail/operate.  Each  control  path  has  its  own  respective  failure  management  unit  which  operates 
with  a  maximum  of  independence  from  the  other  failure  management  units.  These  units  are  me¬ 
chanically  interfaced  with  their  respective  control  paths  to  provide  operational  security.  In  the 
event  of  a  failure,  the  faulty  control  path  is  automatically  disengaged.  If  two  control  paths  that 
share  a  common  piston  fail,  and  hence  are  disengaged,  the  failure  logic  circuitry  will  effect  a  by-pass 
across  the  piston  so  that  it  will  not  adversely  affect  the  operation  of  the  other  piston.  A  condition 
monitor  is  provided  as  a  part  of  the  failure  management  system  to  inform  the  pilot  of  the  operational 
status  of  the  FBW  system.  The  monitor  indicates  soft  failures  as  well  as  failed  and  disengaged  con¬ 
trol  paths.  In  addition,  the  monitor  provides  a  track  error  signal  to  each  control  path  to  provide 
continuous,  automatic  alignment  of  the  servo  valves  which  are  the  end  elements  of  the  paths. 

The  failure  management  system  consists  of  a  failure  sensing  function  and  an  automatic  detection 
disengage  function.  These  functions  are  conceptually  described  in  the  following  paragraphs. 

a.  Failure  Sensing  Function 

The  addition  of  an  LVDT-type  position  transducer  to  the  porting  stage  of  the  servovalves  (second 
stage  on  conventional  servovalves)  allows  the  failure  management  circuitry  to  be  mechanically  inter¬ 
faced  with  the  control  paths.  This  feature  affords  a  more  secure  means  of  sensing  a  failed  or  degraded 
control  path  without  reducing  the  reliability  of  the  control  path,  and,  hence,  the  transducer  can  be 
used  to  cover  failures  up  to  the  power  piston.  Several  other  ways  to  provide  a  valve  feedback  signal 
for  this  failure  monitor  concept  were  considered.  For  example,  differential  pressure  across  the 
second  stage  of  a  conventional  servovalve  can  be  used.  Also,  the  current  flow  through  the  first 
stage  (flapper  valve  coil)  can  be  used  and  is  more  economical.  However,  neither  of  these  approaches 
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will  provide  100  percent  failure  coverage  and  were  discarded  in  favor  of  the  valve  position  trans¬ 
ducer  approach.  Valves  of  this  type  are  currently  available. 

The  basic  failure  sensing  function  for  each  power  actuator  channel  is  provided  simply  by  using  four 
equal  value  resistors  in  conjunction  with  the  4-valve  position  transducers.  Connection  of  the  re¬ 
sistors  as  shown  in  Figure  115  constitutes  a  very  simple  and  reliable  voting  concept  that  allows  each 
control  path  to  comparatively  monitor  itself,  determine  a  failure,  and  disengage  itself. 

Figure  1 17  is  a  simplified  schematic  of  the  basic  concept  for  sensing  a  failure.  For  normal  opera¬ 
tion,  the  voltage  across  the  valve  position  transducers  should  be  the  same.  Since  the  voltages  across 
the  transducers  are  the  same  regardless  of  valve  position,  there  will  be  no  appreciable  current  in  the 
resistors.  Current  will  flow  only  in  the  resistors  when  the  valve  positions  are  not  in  agreement  If 
one  control  path  has  a  "hard"  failure,  the  respective  porting  stage  will  fully  displace  while  the  others 
will  partially  displace  in  the  opposite  direction.  The  voltage  differences  will  cause  a  current  in  the 
resistor  associated  with  the  failed  control  path  that  is  several  times  higher  than  the  current  in  the 
other  resistors,  thus  providing  a  means  for  identifying  the  failed  path.  For  example,  if  Valve  2b  is 
hardover,  the  other  three  will  be  displaced  a  small  amount  (depending  on  the  actuator  load)  in  the 
opposite  direction  and  each  will  produce  a  transducer  output  voltage. 

See  References  20  and  21  for  a  more  detailed  description  of  the  failure  sensing  function. 

b.  Automatic  Detection/Disengage  Function 


This  function  is  the  part  of  the  failure  management  system  that  detects  the  occurrence  of  a  failure 
and  isolates  the  fault  by  disengaging  the  affected  control  path.  If  the  fault  is  not  of  sufficient  mag¬ 
nitude  to  warrant  a  disengagement,  it  is  presented  to  the  pilot  as  a  soft-fail  (e.g.,  high  null)  indica¬ 
tion.  The  soft-fail  feature  is  a  cautionary  device  for  the  pilot  and  constitutes  a  BITE  function. 

Several  approaches  for  detecting  failures  were  considered  One  approach  was  to  simply  compare 
the  magnitude  of  the  failure  voltage  across  each  sense  resistor  with  a  set  threshold.  The  second 
approach  used  a  scheme  for  comparing  the  four  failure  voltages  to  determine  a  failure.  This  approach 
is  not  as  simple  as  the  first  approach,  but  it  appeared  to  be  more  tolerant  to  failures  and  was  success¬ 
fully  used  in  the  BHT  4-valve  FBW  feasibility  program.  Subsequent  studies,  however,  indicated  that 
an  improved  arrangement  of  the  first  approach  has  some  advantages  and,  as  stated  above,  was  se¬ 
lected  as  the  preferred  approach.  The  major  advantage  of  the  first  approach  is  that  it  has  less  failure 
modes  and  has  a  high  degree  of  operational  independence.  The  selected  failure  detection  technique 
affords  a  failure  management  system  that  is  very  simple  when  compared  to  the  more  conventional 
voting  schemes. 

See  References  20  and  21  for  a  more  detailed  description  of  the  automatic  detection/disengage 
function. 

LABORATORY  TESTS  AND  DEMONSTRATIONS 

The  objective  of  the  laboratory  test  and  demonstration  program  was  to  provide  a  means  of  apprais¬ 
ing  the  4-valve  actuation  system  concept  as  a  candidate  actuation  concept  for  use  in  the  FCS  of  a 
potential  test  vehicle.  The  test  program  allowed  the  4-valve  actuation  concept  to  be  evaluated  in 
terms  of  operational  suitability  audits  ability  to  tolerate  failures. 

Tests  were  conducted  to  investigate  the  effects  of  the  basic  types  of  failures  that  can  occur.  The 
intent  was  to  validate  the  4-valve  actuation  concept  as  a  viable  fault-tolerant  actuation  system  that 
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can  be  interfaced  with  the  FCS  of  the  test  aircraft.  The  AFCS  control  paths,  up  to  and  including 
the  Electro-Hydraulic  Servo  Valves  (EHSV's),  were  tested  to  assure  a  Fault  Tolerance-Level  (FTL) 
of  dual  fail-operate  for  the  worst  conditions.  The  electrical  and  hydraulic  power  systems  were 
tested  to  assure  that  the  failure  effects  on  the  total  system  would  result  in  an  FTL  of  single  fail- 
operate  and  dual  fail-safe.  The  failure  modes  were  simulated  using  the  switches  on  a  failure  sim¬ 
ulation  panel,  which  contained  four  electrical  power  switches,  two  hydraulic  hand  valves,  and 
combinations  of  these  input  devices.  Pertinent  parameters  were  measured  and  recorded  to  define 
failure  effects. 

The  test  results  demonstrated  that  the  4-valve  actuation  system  concept  is  suitable  for  use  in  the 
FCS  of  the  test  aircraft.  Tests  validated  die  concept  in  terms  of  operational  suitability  and  ability 
to  tolerate  failures. 

The  methodology  used  in  the  Integrated  Test  Program  and  the  test  results  are  fully  described  in 
Reference  20. 
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